AES Encrypt

Category: Symmetric Ciphers · Node Type ID: symmetric-aes-encrypt

Encrypts plaintext using NIST AES (128/192/256-bit)

Overview

Encrypts arbitrary binary data using the NIST Advanced Encryption Standard (AES) (FIPS 197) with a 128-bit (16B), 192-bit (24B), or 256-bit (32B) symmetric key. The AES key schedule variant (10, 12, or 14 rounds) is selected automatically at runtime from the byte length of the connected Key input port (in XTS mode, a concatenated double-length key of 32B for AES-128-XTS or 64B for AES-256-XTS is required).

Supports all 9 NIST block cipher modes of operation (GCM, CCM, CBC, CTR, ECB, CFB, OFB, XTS, and KW). Both the Padding parameter and the node's fixed input/output ports dynamically show or hide based on the selected Cipher Mode. When optional IV (16B) or Nonce (12B) ports are left unconnected, the node deterministically uses all-zero bytes (0x00) for reproducible test vectors.

When to Use

Encrypting messages or payloads with modern authenticated encryption (GCM or CCM) where both confidentiality and a 16-byte authentication tag are required.
Prototyping or verifying NIST SP 800-38A/C/D/E/F test vectors across CBC, CTR, ECB, CFB, OFB, XTS disk encryption, or RFC 3394 Key Wrap (KW).
Pairing with AES Decrypt to test end-to-end symmetric encryption and authentication workflows.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Cipher Mode `mode`	`select` Default: `ECB`	Always visible	Selects the block cipher mode of operation and dynamically controls which input/output ports (`IV` vs. `Nonce`/`AAD`/`Auth Tag`) and padding options are visible. See Block Cipher Modes. `ECB`: ECB (Electronic Codebook) `CBC`: CBC (Cipher Block Chaining) `GCM`: GCM (AEAD) `CCM`: CCM (AEAD) `CTR`: CTR (Counter Mode) `CFB`: CFB (Cipher Feedback) `OFB`: OFB (Output Feedback) `XTS`: XTS (Tweakable) `KW`: KW (Key Wrap)
Padding (CBC/ECB) `padding`	`select` Default: `None`	Always visible	Block padding scheme applied to the plaintext before encryption in block-aligned modes (`ECB` and `CBC`). Only visible when `Cipher Mode` is `ECB` or `CBC`. See Padding Schemes. `None`: None `Zero`: ISO/IEC 9797-1 Method 1 (Zero Padding) `ISO7816`: ISO/IEC 9797-1 Method 2 (ISO/IEC 7816-4) `ISO97971M3`: ISO/IEC 9797-1 Method 3 `PKCS7`: PKCS#7 (RFC 5652) `NIST80038B`: NIST SP 800-38B `ANSIX923`: ANSI X9.23
Unify Errors `errorUnify`	`boolean` Default: `false` Supports Variable Reference (`$var`: `bool`)	Always visible	When enabled (`true`), replaces any built-in runtime error thrown by this node with the custom code and message configured below.
Unified Error Code `errorUnifyCode`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorUnify` is `true`	Custom error code emitted when Unify Errors is enabled.
Unified Error Message `errorUnifyMessage`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorUnify` is `true`	Custom error message emitted when Unify Errors is enabled.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (5 total; conditionally visible ports depend on parameter settings as shown below).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Key`	`key`	`Bytes` (16/24/32B)	Required	Always visible	AES secret key: `16` bytes (AES-128), `24` bytes (AES-192), or `32` bytes (AES-256). In `XTS` mode, supply `32` bytes (AES-128-XTS) or `64` bytes (AES-256-XTS).
`Plaintext`	`plaintext`	`Bytes`	Required	Always visible	Raw plaintext bytes (`Uint8Array`) to encrypt. In `ECB`/`CBC` with `Padding = None`, length must be a multiple of 16 bytes; in `XTS`, at least 16 bytes; in `KW`, a multiple of 8 bytes (≥ 16B).
`IV`	`iv`	`Bytes` (16B)	Optional	When `mode` is `CBC` or `CTR` or `CFB` or `OFB` or `XTS`	16-byte initialization vector, initial counter block, or XTS tweak. Only visible in `CBC`, `CTR`, `CFB`, `OFB`, and `XTS` modes. Defaults to 16 zero bytes if unconnected.
`Nonce`	`nonce`	`Bytes` (12B)	Optional	When `mode` is `GCM` or `CCM`	12-byte (96-bit) AEAD nonce. Only visible in `GCM` and `CCM` modes. Defaults to 12 zero bytes if unconnected.
`AAD`	`aad`	`Bytes` (GCM/CCM only)	Optional	When `mode` is `GCM` or `CCM`	Optional Additional Authenticated Data (`Uint8Array`) authenticated by the AEAD tag without being encrypted. Only visible in `GCM` and `CCM` modes.

Output Ports

Port Nature: Fixed Output Ports (2 total; conditionally visible ports depend on parameter settings as shown below).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Ciphertext`	`ciphertext`	`Bytes`	Always visible	Encrypted output bytes (`Uint8Array`). In `KW` mode, includes the 8-byte integrity check value header.
`Auth Tag`	`tag`	`Bytes` (GCM/CCM)	When `mode` is `GCM` or `CCM`	16-byte (128-bit) authentication tag produced in `GCM` and `CCM` modes. Hidden in non-AEAD modes.

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute. Enabling Unify Errors (errorUnify) replaces all error codes below with your configured unified error code and message.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_LENGTH`	Invalid key length	Raised when `Key` is not 16, 24, or 32 bytes (or not 32 or 64 bytes in `XTS` mode).
`INVALID_IV_LENGTH`	Invalid IV length	Raised when a connected `IV` is not 16 bytes or a connected `Nonce` is not 12 bytes.
`INVALID_NONCE_LENGTH`	Invalid nonce length	Raised when a connected AEAD or stream-cipher `Nonce` is not 12 bytes (96 bits).
`PLAINTEXT_NOT_BLOCK_ALIGNED`	In NoPad mode the plaintext length must be a multiple of the block size	Raised in `ECB` or `CBC` mode when `Padding = None` and `Plaintext` length is not a multiple of 16 bytes.
`DATA_TOO_SHORT`	Data is too short	Raised when the input data is shorter than the minimum length required by the mode (e.g., < 16B in XTS or Key Wrap mode).

Examples

Authenticated Encryption with AES-256-GCM

Encrypt a UTF-8 message with a 32-byte key, 12-byte nonce, and optional AAD.

Set Cipher Mode to GCM (Authenticated Encryption).
Connect a 32-byte key to Key, a 12-byte nonce to Nonce, and your message bytes to Plaintext.
Wire Ciphertext and Auth Tag to AES Decrypt or Output Inspector.