nx_aes.nx

nx_aes.nx -- AES-128 block cipher (FIPS 197). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/nist/fips_197 128-bit key, 128-bit block, 10 rounds. Substrate-original NishiLang implementation of the Rijndael algorithm as specified by FIPS PUB 197 (NIST, 2001). Closes substrate's symmetric-cipher gap alongside the existing nx_chacha20 stream cipher; required for TLS 1.3 interop (TLS_AES_128_GCM_SHA256 is the most common cipher suite). Algorithm (FIPS 197 §5): Encrypt(plaintext, expanded_key): state = plaintext XOR round_key[0] for round in 1..9: state = SubBytes(state) state = ShiftRows(state) state = MixColumns(state) state = state XOR round_key[round] state = SubBytes(state) state = ShiftRows(state) state = state XOR round_key[10] return state KeyExpansion (FIPS 197 §5.2): expands the 128-bit key into 11 128-bit round keys (176 bytes total). Each new word is either XOR of previous + word-4-back, or (every 4 words) goes through RotWord -> SubWord -> XOR with Rcon. State layout: 16-byte array indexed [r,c] = state[r + 4*c] per FIPS 197 §3.4 (column-major in the bytes-on-the-wire order). TIMING SIDE-CHANNEL POSTURE (honest): The S-box is implemented as a 256-byte table lookup with secret-dependent index. On shared-cache architectures this leaks key bits via cache-timing analysis (Bernstein 2005). Substrate-acceptable for MCU/sensor targets where there is no shared cache. For server-class targets, substrate's named improvement is BITSLICE-AES which is timing-side-channel resistant by construction; queued as nx_aes_bitslice.nx.