AES (Advanced Encryption Standard)

2 min

AES (Advanced Encryption Standard) is a symmetric algorithm, using the same key for both encryption and decryption. You can choose between simple and advanced modules in the Encryptor app. Advanced modules are recommended, giving you more control and allowing your key to be hidden.

The AES algorithm has four components:

Component	Description
Key	Select a key of either 128 or 256 bits. A longer key provides more security.
Initialization vector	A random value used at the beginning of encryption to make sure the same data looks different each time it's encrypted, so no one can guess the plaintext value from the results. The initialization vector is sometimes called Nonce. You can choose UTF-8, Base64, or Hexadecimal for encoding.
Authentication tag	A code generated after encrypting the message. It is also called an integrity check value (ICV) or message authentication code (MAC). This value is calculated using the cyphertext and the initialization vector. It is a unique value generated from the encrypted message. The tag is sent with the message and the recipient repeats the process to generate the authentication tag using the received message. If the two tags are the same, the shared message is the same.
Modes	Methods for encrypting data. CBC (Cipher Block Chaining) mode: Encrypts each block of data by combining it with the previous block's ciphertext and requires an initialization vector to start the chain. GCM (Galois/Counter) mode: Combines encryption with the authentication tag to ensure the integrity of the data.

In this example we will:

Select content to encrypt and send to a recipient.

Select a secret key to share with the recipient ahead of time, to decrypt the content.

Encrypt the message.

Decrypt the message.

Step 1: Select content to encrypt

In this example, we set a variable InitialText with our content to send with encryption.

In your scenario, you may have the content set another way or pulled from a different source.

Step 2: Select a secret key

A secret key can be any content agreed upon by the sender and recipient: a word, a phrase, or a series of characters.

In AES simple encryption and decryption, the secret key is not hidden. If you share the scenario with any other users or download the blueprint to share, your secret key is exposed.

Step 3: Encrypt the message:

Add the Encryptor > AES Encrypt (simple) module to your scenario.

Select the Input encoding. In this example, we use UTF-8.

In the Data field, map or input the value of the content you want to encrypt.

Select the Output encoding. In this example, we use hexadecimal.

In the Secret key field, enter the secret key you have shared with the recipient.

The secret key is not hidden. If you share the scenario with any other users or download the blueprint to share, your secret key is exposed.

Click Save.

The message is encrypted. The output of this module is the encrypted message in hexadecimal format.

Step 4: Decrypt the message:

Add the Encryptor > AES Decrypt (simple) module to your scenario.

Select the Input encoding. In this example, we use hexadecimal to match the output encoding used to encrypt the message.

In the Data field, map or input the value of the content you want to decrypt.

Select the Output encoding. In this example, we use UTF-8.

In the Secret key field, enter the secret key you have shared with the sender.

The secret key is not hidden. If you share the scenario with any other users or download the blueprint to share, your secret key is exposed.

Click Save.

The message is decrypted. The output of this module is the decrypted message and should match the original content set in the InitialText variable.

If the wrong secret key is used, the message has been modified, or the encoding does not match, the module outputs an error.

In this example we will:

Select content to encrypt and send to a recipient.

Generate an AES key.

Set an initialization vector.

Encrypt the message (GCM ciphor algorithm).

Decrypt the message (GCM ciphor algorithm).

Step 1: Select content to encrypt

In this example, we set a variable InitialText with our content to send with encryption.

In your scenario, you may have the content set another way or pulled from a different source.

Step 2: Generate an AES key

To encrypt and decrypt messages with AES, the key must be shared between the sender and recipient ahead of time.

To generate an AES key:

Go to an encryption key generator website of your choice. In this example, we use this tool.

Select or set the following values: Key Size: 128 or 256 bits. In this example we use 256 bits. Format: Hexadecimal or Base64. In this example, we use hexadecimal.

Click Generate to get your AES Key. If you are using a different tool to generate your key, your steps may be different.

Copy the AES key save it in a safe place.

You will use this AES key to create a keychain and encrypt your content.

Step 3: Set an initialization vector

Although AES key generator websites also provide initialization vectors, it is best to use a different initialization vector every time, for more secure encryption.

For this reason, we use the Set variable module to generate a new initialization variable before the content is encrypted.

Add the Tools > Set variable module to your scenario.

In the Variable name field, enter a name for your initialization vector.

In the Variable value field, enter the following to generate a substring of a unique ID (128 bit) with only the first 16 characters:

substring(uuid; 0; 16)

The UUID variable can be found under the Text and binary functions tab:

The initialization vector variable is mapped in the encryption module in the next step.

You need to use a 128-bit initialization vector for the GCM cipher algorithm. For the CBC cipher algorithm, you can use a 96-bit initalization vector instead. GCM is the preferred method, shown here.

Step 4: Encrypt the message (GCM ciphor algorithm)

Add the Encryptor > AES Encrypt (advanced) module to your scenario.

Click Create a keychain.

Enter a Name for your AES key.

In the Key field, enter your AES key.

In the Key Encoding field, select Hexadecimal.

Click Create.

In the Bits field, select 256.

In the Input encoding field, select UTF-8.

In the Data field, map the value of the content you want to encrypt.

In the Output encoding field, select Hexadecimal.

In the Cipher Algorithm field, select GCM.

In the Initialization Vector Encoding field, select UTF-8.

In the Initalization Vector field, map the value of the initialization vector created in the previous Set variable module.

Click Save.

The message is encrypted.

The output of this module has the Data, Initialization Vector, and Authentication Tag in hexadeximal format. You will use these values to decrypt the message.

If you run the scenario again, the output data will be different because the initialization vector is a variable that changes with each run.

The initialization vector and the authentication tag can be sent in cleartext to the recipient; they don't need to be secured.

Step 5: Decrypt the message (GCM ciphor algorithm)

Add the Encryptor > AES Decrypt (advanced) module to your scenario.

Use the same keychain created in Step 4 above or create a new keychain with the same values.

In AES encryption, the sender and recipient use the same key to encrypt and decrypt the message.

In the Bits field, select 256.

In the Input encoding field, select Hexadecimal to match the encryption output encoding.

In the Data field, map the value of the encryption output Data.

In the Output encoding field,select UTF-8.

In the Cipher Algorithm field, select GCM to match the same algorithm used for encryption.

In the Initialization Vector Encoding field, select Hexadecimal to match the encyption output encoding of this value.

In the Initalization Vector field, map the value of the initialization vector from the encryption output.

In the Authentication Tag Encoding field, select Hexadecimal to match the encryption output encoding of this value.

In the Authentication Tag field, map the value of the authentication tag from the encryption output.

Click Save.

The message is decrypted. The output of this module is the decrypted message and should match the original content set in the InitialText variable.

If the wrong key is used, the message has been modified, or there is a discrepancy with the initalization vector or authentication tag, the module outputs an error.

AES (Advanced Encryption Standard)

Example: Encrypt and decrypt a message with the Encryptor app AES (simple) modules

Example: Encrypt and decrypt a message with the Encryptor app AES (advanced) modules