Block cipher simulator
AES, the Advanced Encryption Standard (NIST FIPS-197), is the cipher an encrypting SSD runs on every block it writes. Walk one block through it, then see what the drive adds: a tweak from each sector’s address, a media key locked under your password, and an erase that takes no time at all.
The walkthrough
Five steps, all live
Every step is on screen from the start. Change a setting and only the picture beside it changes.
AES lays 16 bytes out as a 4 by 4 grid and runs it through rounds of four moves. Step through them, then pick a byte in the After grid to see its arithmetic.
Step 1
Before
Round key
After pick a byte
Ciphertext
One key in, one round key per round out. The row for the step on screen is marked, and any word shows how it was made.
Flip one bit of the plaintext or the key and count how many of the 128 output bits change after each round. A strong cipher spreads the change to about half the bits and keeps it there.
The two ciphertexts, bit by bit (marked where they differ)
| Round | Bits that differ |
|---|
AES-XTS, key wrapping, crypto erase
A self-encrypting SSD runs AES in hardware between the host interface and the flash, so the NAND only ever holds ciphertext. This is a demo, and its keys are predictable on purpose.
ECB encrypts each 16-byte block on its own, so equal blocks give equal ciphertext and the shape survives. XTS also mixes in the sector number and the block position, and the shape is gone.
XTS encrypts the sector's LBA into a tweak and folds it into every block. Write the same 512 bytes to two addresses and the flash holds unrelated ciphertext.
First tweak
Ciphertext, first 32 bytes
First tweak
Ciphertext, first 32 bytes
The password only unlocks a media key that never leaves the drive. Changing it rewrites the wrapped key, and a crypto erase replaces the media key so the old data reads as noise.
Demo only: shown in clear, with a fixed salt. Never type a real password here.
The cipher is real AES as FIPS-197 defines it, for 128, 192 and 256-bit keys, and its outputs are checked against the standard's test vectors. XTS follows IEEE 1619 and the key wrap follows RFC 3394; both are checked against published vectors and against OpenSSL.
Each round is four moves, with the FIPS-197 name beside each plain one. SubBytes swaps each byte through the S-box, ShiftRows slides rows 1, 2 and 3 left by one, two and three places, MixColumns blends each column, and AddRoundKey mixes in a round key with XOR. The last round skips MixColumns.
The key schedule stretches the key into one 16-byte round key per round, four 32-bit words at a time. The key itself fills the first words: all of round key 0, and for AES-192 and AES-256 part or all of round key 1 as well.
One round only stirs part of the block, because a change in one byte reaches one column at most. A key bit that first enters a later round key starts spreading later, which is why a key flip can lag a plaintext flip.
The picture is stored the way a drive stores data. Each row is one 512-byte sector and each 4 by 4 tile is one 16-byte block, and each ciphertext tile is drawn as one flat gray taken from its block's first byte, so equal blocks look equal. The pictures use their own fixed demo keys, not the key in step 1.
XTS takes the LBA as its tweak. The drive encrypts the sector number with the second half of the key, then shifts that value along for every block, so the same 512 bytes at two LBAs share nothing on the flash.
The media key is made inside the drive and never leaves it. The drive stores it wrapped (RFC 3394) under a key derived from the password, and in this lab's drive the 64-byte media key becomes 72 bytes once wrapped. Changing the password rewrites those 72 bytes, and replacing the media key makes every sector unreadable at once.