During AES algorithm processing, a 4 x 4 array of bytes known as the state is modified using multiple rounds. Full encryption requires 10 to 14 rounds, depending on the size of the key. The following table shows the key sizes and the required number of rounds:

Once the state is initialized with the input to the cipher, four operations are performed in four stages to encrypt the input. These stages are: AddRoundKey, SubBytes, ShiftRows, and MixColumns:

1. In the AddRoundKey step, the state array is XOR'd with a subkey, which is derived from the master key
2. SubBytes is the substitution step where a lookup table (S-box) is used to replace all bytes of the state array
3. The ShiftRows step is used to shift each row to the left, except for the first one, in the state array to the left in a cyclic and incremental manner
4. Finally, all bytes are mixed in the MixColumns step in a linear fashion, column-wise

The preceding steps describe one round of AES.

In the final round (either 10, 12, or 14, depending on the key size), stage 4 is replaced with AddRoundKey to ensure that the first three steps cannot be simply reversed:

Various cryptocurrency wallets use AES encryption to encrypt locally-stored data. Especially in Bitcoin wallet, AES-256 in the CBC mode is used.

Here's an OpenSSL example of how to encrypt and decrypt using AES:

$ openssl enc -aes-256-cbc -in message.txt -out message.bin 
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:
$ ls -ltr
    
-rw-rw-r-- 1 drequinox drequinox 14 Sep 21 05:54 message.txt
-rw-rw-r-- 1 drequinox drequinox 32 Sep 21 05:57 message.bin
$ cat message.bin  

The following are the contents of the message.bin file:

Note that message.bin is a binary file. Sometimes, it is desirable to encode this binary file in a text format for compatibility/interoperability reasons. The following command can be used to do just that:

$ openssl enc -base64 -in message.bin -out message.b64
$ ls -ltr
-rw-rw-r-- 1 drequinox drequinox 14 Sep 21 05:54 message.txt
-rw-rw-r-- 1 drequinox drequinox 32 Sep 21 05:57 message.bin
-rw-rw-r-- 1 drequinox drequinox 45 Sep 21 06:00 message.b64
$ cat message.b64
U2FsdGVkX193uByIcwZf0Z7J1at+4L+Fj8/uzeDAtJE=  

In order to decrypt an AES-encrypted file, the following commands can be used. An example of message.bin from a previous example is used:

$ openssl enc -d -aes-256-cbc -in message.bin -out message.dec 
enter aes-256-cbc decryption password:
$ ls -ltr
-rw-rw-r-- 1 drequinox drequinox 14 Sep 21 05:54 message.txt
-rw-rw-r-- 1 drequinox drequinox 32 Sep 21 05:57 message.bin
-rw-rw-r-- 1 drequinox drequinox 45 Sep 21 06:00 message.b64
-rw-rw-r-- 1 drequinox drequinox 14 Sep 21 06:06 message.dec
$ cat message.dec
Datatoencrypt  

Astute readers will have noticed that no IV has been provided, even though it's required in all block encryption modes of operation except ECB. The reason for this is that OpenSSL automatically derives the IV from the given password. Users can specify the IV using the following switch:

-K/-iv      , (Initialization Vector) should be provided in Hex.  

In order to decode from base64, the following commands are used. Follow the message.b64 file from the previous example:

$ openssl enc -d -base64 -in message.b64 -out message.ptx
$ ls -ltr
-rw-rw-r-- 1 drequinox drequinox 14 Sep 21 05:54 message.txt
-rw-rw-r-- 1 drequinox drequinox 32 Sep 21 05:57 message.bin
-rw-rw-r-- 1 drequinox drequinox 45 Sep 21 06:00 message.b64
-rw-rw-r-- 1 drequinox drequinox 14 Sep 21 06:06 message.dec
-rw-rw-r-- 1 drequinox drequinox 32 Sep 21 06:16 message.ptx 
$ cat message.ptx 

The following are the contents of the message.ptx file:

There are many types of ciphers that are supported in OpenSSL. You can explore these options based on the preceding examples. A list of supported cipher types is shown in the following screenshot:

OpenSSL tool can be used to experiment with all the ciphers shown in the screenshot.