| name | implementing-aes-encryption-for-data-at-rest |
| description | AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM m |
| domain | cybersecurity |
| subdomain | cryptography |
| tags | ["cryptography","encryption","aes","data-at-rest","symmetric-encryption"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.DS-01","PR.DS-02","PR.DS-10"] |
Implementing AES Encryption for Data at Rest
Overview
AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM mode for encrypting files and data stores at rest, including proper key derivation, IV/nonce management, and authenticated encryption.
When to Use
- When deploying or configuring implementing aes encryption for data at rest capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Common Misconfigurations & Verification
- AES-ECB mode: identical plaintext blocks produce identical ciphertext blocks (the "ECB penguin"). Never use
modes.ECB() for data at rest — use AES-256-GCM (AEAD). Detect by encrypting a buffer of repeated 16-byte blocks and checking the ciphertext for repeated blocks.
- Static or reused GCM nonce: reusing a 96-bit nonce with the same key is catastrophic — it leaks the XOR of plaintexts and allows authentication-key recovery. Generate the nonce with
os.urandom(12) per message; never hardcode it. Verify nonces differ across two encryptions of the same plaintext.
- CBC/CTR without a MAC (no auth tag): unauthenticated ciphertext is malleable and enables padding-oracle attacks. Use GCM/CCM, or encrypt-then-HMAC.
- Dropping/ignoring the GCM tag on decrypt: decryption MUST fail if the tag is wrong.
- Raw password as key, or weak KDF: derive with PBKDF2 (≥600k iters) or Argon2id; use a random per-file salt.
- The critical test — tamper rejection: flip one byte of the ciphertext (or the tag) and confirm decryption raises
InvalidTag and returns NO plaintext. A scheme that returns data after tampering is broken. Also confirm decrypt with the wrong key fails rather than yielding garbage.
Prerequisites
- Familiarity with cryptography concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Implement AES-256-GCM encryption and decryption for files
- Derive encryption keys from passwords using PBKDF2 and Argon2
- Manage initialization vectors (IVs) and nonces securely
- Encrypt and decrypt entire directory trees
