AES: From an Open NIST Competition to FIPS 197

The Data Encryption Standard gave U.S. federal agencies a shared cipher for sensitive, unclassified information, but by the mid-1990s NIST was preparing for a successor. Its framing was deliberately measured: the 1997 Federal Register notice that opened the Advanced Encryption Standard effort said DES “will continue to be of sufficient strength for many applications” and that a multi-year transition would be needed. The AES that followed is best read as a sequence of distinct stages - an open call, a public evaluation, a selection, a formal approval, and an implementation phase with explicit boundaries.

An open call, not a procurement

NIST announced the initiation of the AES effort on January 2, 1997, and published draft evaluation criteria for comment; a public workshop on those criteria was held on April 15, 1997. The formal call for candidate algorithms appeared on September 12, 1997. It asked for an unclassified, publicly disclosed symmetric block cipher, available worldwide on a royalty-free basis, supporting 128-bit blocks with 128-, 192-, and 256-bit keys. Submissions were due June 15, 1998. This was a standards solicitation, not a government purchase of a custom device: submitters agreed that accepted algorithms would be publicly analyzed, that submissions could not be withdrawn after the deadline, and that NIST would not accept modifications during the first round of review. Any candidate had to be defensible as a public specification, not merely as a working product.

Three criteria, weighted by security

The same notice set out the evaluation criteria that the later NIST report describes as developed from public comments and the April 1997 workshop. They fell into three categories. Security came first and was named the most important factor: resistance to cryptanalysis, output indistinguishable from a random permutation, soundness of the mathematical basis, and the practicality of any published attacks. Cost covered licensing conditions, computational efficiency across platforms, and memory requirements - with Round 1 focused on 128-bit-key software performance and Round 2 adding hardware and the larger key sizes. Algorithm and implementation characteristics covered flexibility, suitability for both hardware and software, and relative simplicity of design. The criteria help explain why the process rewarded measured engineering: candidates had to be assessed as implementable systems, not as isolated mathematical objects.

From fifteen candidates to five finalists

On August 20, 1998, at the first AES candidate conference, NIST announced fifteen accepted candidates, submitted by industry and academic teams from twelve countries. The cryptographic community was invited to attack the designs, and conferences in March 1999 and April 2000, together with an electronic discussion forum, concentrated that analysis. In August 1999 NIST narrowed the field to five finalists: MARS, RC6, Rijndael, Serpent, and Twofish. Round 2 review extended from that announcement until the comment period closed on May 15, 2000. The finalists represented genuinely different constructions, including Feistel networks and substitution-linear transformation networks, so the choice was not among minor variants of one scheme.

Selection was not approval

On October 2, 2000, the Commerce Department announced that Rijndael, submitted by Joan Daemen and Vincent Rijmen, had been selected to propose for the AES. The announcement described Rijndael as the best combination of security, performance, efficiency, implementability, and flexibility, while noting that all five finalists offered a very high degree of security. The accompanying report was equally careful: each finalist appeared to offer adequate security and none was outstandingly superior; any could have served. Rijndael, however, performed consistently well in both hardware and software, had very low memory requirements, offered excellent key setup time and good key agility, and its operations were among the easiest to defend against power and timing attacks. Crucially, the October 2000 action selected a candidate to propose. It did not itself create a federal standard. NIST then prepared a draft Federal Information Processing Standard, published for public comment on February 28, 2001.

Approval and implementation

FIPS 197 was published on November 26, 2001, and on December 6 the Federal Register announced the approval of the standard. It took effect on May 26, 2002, compulsory and binding on federal agencies for the protection of sensitive, unclassified information. It specified three variants - AES-128, AES-192, and AES-256 - each operating on 128-bit blocks. The public record shows limited but consequential comment: twenty-one private-sector organizations, individuals, and groups of individuals, plus one federal organization, responded, and none opposed adoption. Some asked for additional key or block sizes and for more rounds. NIST declined to add sizes at that time, explaining that others had not received the same public analysis, and kept the round counts as submitted because changing them would invalidate completed security analyses and restart the evaluation. The comment record also shows a boundary: NIST treated padding and optimization as outside the standard’s scope, to be handled by modes-of-operation work and by application protocols.

What the record does not claim

Several beliefs often attached to AES exceed what these documents establish. FIPS 197 specifies an algorithm and conformance requirements, not a complete security architecture; key management, padding, and protocol integration sit elsewhere in the standards stack. Selecting Rijndael did not prove that no better design existed or that cryptanalysis had ended. The selection report described adequate security, noted many unknowns about future platforms, and committed NIST to follow developments and formally re-evaluate the standard every five years. The approval notice also separates validation of an implementation’s conformance to the AES specification from validation of a cryptographic module; it does not describe either path as certifying the security of a complete system. The standard did not absorb all of Rijndael’s optional features: larger block sizes and other key sizes were left out intentionally, not by oversight. And the algorithm itself has not changed since approval: the 2023 revision of FIPS 197 was editorial and, by NIST’s own description, made no technical changes.

Why the sequence matters

The AES episode is a useful model because it separated functions that are easy to blur: proposing designs, evaluating them publicly, choosing one, adopting it through rulemaking, and validating implementations. Each stage left a documentary trail, and each stage had limits. The competition’s openness - public specifications, public attacks, public comments - gave implementers evidence they could examine rather than trust. Read together, the sources show how a modern encryption standard was built: not simply by crowning a cipher, but by making the path from submission to effective date legible and reviewable.

Related:

Sources: