01 / From DES to AES
DES grew out of IBM's Lucifer design and became a US federal standard in 1977. Its 64-bit block and 56-bit effective key once made engineering sense, but affordable exhaustive search overtook it. Repeated DES operations extended the life of legacy systems as 3DES, still constrained by the small block and cost. DES/3DES are here for old-data interoperability. A successful round trip is not proof of security.
NIST opened the AES competition in 1997. Rijndael was selected in 2000 and became FIPS 197 in 2001. AES has a 128-bit block and 128-, 192- or 256-bit keys; key size and block size are different. AES-256-GCM names an algorithm, key size and mode, not a separate block cipher.
02 / The mode defines the security properties
ECB maps equal plaintext blocks to equal ciphertext blocks, exposing structure. CBC needs a properly random IV and padding but does not authenticate ciphertext. Valid padding does not prove that data is unchanged. Production protocols must authenticate before accepting decrypted data, avoiding tampering and padding-oracle attacks.
GCM combines counter-mode encryption with authentication, binding ciphertext, AAD and a tag. Reusing a nonce with the same key is a serious error: it can expose plaintext relationships and undermine authentication. Random 96-bit nonces can still collide. Bound per-key message counts, rotate keys and manage nonce allocation rather than using a key indefinitely.
AAD is authenticated, not encrypted. It can bind tenant, object, version or protocol-header information. This page uses a 128-bit GCM tag and returns ciphertext || tag. Decryption requires the same AAD.
03 / SM4 and the parameter envelope
SM4 originated in wireless-network security and was standardized in GB/T 32907-2016. Its block and key are both 128 bits. SM4-CBC and SM4-ECB inherit their modes' limitations; a national algorithm designation does not add message authentication.
A key is not a password string. Generate AES key bytes securely or derive them with an appropriate KDF; do not zero-pad a password into a key. Compatibility modes here use strictly checked PKCS#7 padding. DES's eight-byte representation includes parity bits, not 64 bits of effective security.
The JSON envelope stores the algorithm, mode, IV, AAD, padding and ciphertext, but no key. It is this tool's interchange format, not JWE or CMS. It adds no integrity to unauthenticated modes.
| Standards | Engineering constraints |
|---|
| FIPS 197 / SP 800-38D | AES and GCM. Manage tags, nonces, AAD and key rotation according to the protocol. |
| SP 800-38A / GB/T 32907-2016 | CBC/ECB and SM4. Confidentiality is not integrity. |
| SP 800-67 Rev.2 | TDEA/3DES recommendations were withdrawn in 2024. Govern legacy decryption separately from new encryption. |
Implementation limits: AES uses WebCrypto and SM4 uses sm-crypto. DES/3DES use the unmaintained CryptoJS 4.2.0 for compatibility experiments only, not as a production algorithm recommendation.
Key management is more than choosing an algorithm
A KMS needs a verifiable lifecycle: generation, permitted uses, version rotation, revocation, backup and recovery, destruction, and audit. A data-encryption key (DEK) encrypts data; a key-encryption key (KEK) protects the DEK. Envelope encryption lets a master key stay within a controlled boundary rather than travel with business data. Bind key identifiers and versions to algorithms, purposes and authorization policies. A Hex string alone cannot describe those rules.
A browser page cannot replace non-exportable keys, HSM isolation, dual control, least privilege or audit evidence. Keys here are exportable for interoperability experiments. Private keys are not saved automatically, and a protection passphrase is used only for local export. Clearing discards the Worker and UI references; JavaScript garbage collection does not guarantee provable erasure of physical memory. Generate production private keys, passwords and master keys in an environment that meets your organization's controls.