🧭 Start Here — The Vocabulary in One Panel
Every exhibit below uses a handful of load-bearing words. Here is each in one plain sentence, so the comparison table's Structure and transparency rows read like English, not jargon. Terms in the exhibits link back here.
- Block cipher
- A recipe that scrambles one fixed-size chunk of data (here, a block of 128 bits = 16 bytes) at a time. The same key both scrambles and unscrambles.
- Key
- The secret number that controls the scrambling. A 256-bit key is one of 2²⁵⁶ possibilities — far too many to guess. Bigger keys leave more headroom against future attacks.
- Round
- One pass of scrambling. Ciphers repeat a simple round many times (SM4 does 32); each round mixes the data a little more, so more rounds = larger security margin.
- S-box (substitution box)
- A fixed lookup table that swaps each byte for another (00→63, 01→7c, …). It is the non-linear heart of the cipher — the part that resists algebra. Whether its design is public and explained is the whole "transparency" question.
- SPN (substitution-permutation network)
- A round design that substitutes every byte (S-box), then permutes/mixes them across the whole block, then adds the round key. AES, ARIA, and Kuznyechik are SPNs. Every bit touches every other bit quickly.
- Feistel network
- A different round design: split the block in half, run one half through a scrambling function, XOR it into the other half, swap. Its trick is that encryption and decryption run the same circuit. Camellia and SM4 use Feistel structures.
- Involution
- A function that is its own inverse: apply it twice and you are back where you started, f(f(x)) = x. Reusing one involutory circuit for both encrypt and decrypt saves hardware. Watch for it in ARIA's diffusion layer (Exhibit 2).
- Diffusion layer
- The mixing step that spreads each byte's influence across the whole block, so one changed input bit avalanches into many changed output bits (Exhibit 5).
✅ Verified Against Official Test Vectors
Every cipher here runs real operations — no simulation. To prove it, the page
encrypts each cipher's known-answer test (KAT) from its defining
standard, right now in your browser, and checks the output byte-for-byte against the
published ciphertext. The same vectors gate the repository's npm test suite.
| Result | Vector | Source | Expected ciphertext |
|---|
🇯🇵 Exhibit 1 — Camellia-256
ISO/IEC 18033-3 · IETF RFC 3713 · CRYPTREC approved
Structure: Feistel network with SPN-like keying layers (FL/FL⁻¹)
Block size: 128-bit · Key sizes: 128, 192, 256-bit
Interactive Encrypt / Decrypt
Side-by-Side: Camellia-256-CBC vs AES-256-CBC
Same plaintext, same key, same IV — different ciphertext. Both decrypt correctly.
Camellia-256-CBC
AES-256-CBC
Same inputs, different ciphertext — because Camellia and AES are different algorithms. Two consequences follow, and both matter: first, interoperability requires both sides to agree on the algorithm — a Camellia sender and an AES receiver cannot talk, even with the identical key. Second, and just as important, "different-looking output" is not evidence of more security. Both here are 256-bit ciphers with comparable security margins; the divergent hex tells you they are distinct, not that either is stronger.
Round Structure
Camellia uses 18 rounds for 128-bit keys or 24 rounds for 192/256-bit keys. AES uses 10/12/14 rounds for the same key sizes. Camellia's extra rounds were a deliberate conservative design decision — more rounds mean a larger security margin against future cryptanalysis.
Camellia is on the IETF Standards Track for TLS (RFC 5932, originally RFC 4132), one of only two ciphers here that are — ARIA is the other (RFC 6209). But Camellia stands out for breadth of independent vetting: equivalent security to AES, a fully published design rationale, and active maintenance by Japan's CRYPTREC. For systems that need an AES alternative with the strongest international scrutiny, Camellia is the most defensible choice in this group.
🇰🇷 Exhibit 2 — ARIA-256
Korean Standard KS X 1213 · IETF RFC 5794 (not in ISO/IEC 18033-3)
Structure: SPN (like AES) with an involutory diffusion layer
Block size: 128-bit · Key sizes: 128, 192, 256-bit
Interactive Encrypt / Decrypt
Where ARIA's Involution Really Lives
First, plainly: an involution is a function that is its own inverse — apply it twice and you are back where you started, f(f(x)) = x. ARIA is an involutional cipher, but the involution is in its diffusion layer, not its S-boxes. This distinction is commonly garbled; getting it right is the difference between understanding ARIA and parroting it.
1. The S-box is not involutory
ARIA's S₁ is the AES (Rijndael) S-box. Applying it twice does not return the original byte, so decryption needs a separate inverse, S₁⁻¹. Try any byte:
Note S₁(S₁(x)) ≠ x, but S₁⁻¹(S₁(x)) = x. That second, distinct table is exactly what an involution would let you avoid — and ARIA's S-boxes do not.
Watch the lookup happen in the table
The S-box is just a 16×16 grid of 256 output bytes. To look up S₁(x), split the input byte into its high nibble (the row) and low nibble (the column) and read the cell where they meet. Press Animate lookup to trace S₁, then S₁ again (landing somewhere else — the proof it is not an involution), then S₁⁻¹ back to your byte.
2. The diffusion layer is involutory
ARIA's 16×16 binary diffusion matrix A satisfies A(A(x)) = x for every 128-bit state (RFC 5794: "Note that A is an involution"). Apply it twice and you land back on your input — so the same diffusion circuit serves both encryption and decryption. That is ARIA's real hardware advantage.
ARIA is legally required for products sold into Korean government and financial markets. Its involutional diffusion layer is a deliberate engineering choice: reusing one diffusion circuit for both directions cuts hardware gate count. If you are building systems for Korean regulatory compliance, ARIA is not optional — and now you can say precisely why it is built the way it is.
🇨🇳 Exhibit 3 — SM4
GB/T 32907-2016 · ISO/IEC 18033-3 (Amendment 1:2021)
Structure: 32-round non-balanced Feistel network with a nonlinear T-transform (its S-box plus mixing)
Block size: 128-bit · Key size: 128-bit only (no 192 or 256-bit variant)
Interactive Encrypt / Decrypt
Watch the 32 Rounds Run
Encrypting above kicks off this schematic. SM4 keeps the 128-bit block as four 32-bit words (X₀ X₁ X₂ X₃). Each round takes the newest three words plus a round key, pushes them through the substitute → mix → add-round-key pipeline (that is the T-transform), and the result becomes the next word — a Feistel shift. Watch each stage light up: this is why 32 rounds diffuses a single input bit across the whole block, not just a dot to count.
Schematic of the real data flow (word rotation + T-transform per SM4 / GB/T 32907-2016). The hex words shown are the live state you just encrypted; the stage highlighting is illustrative timing, not a claim about gate-level latency.
SM4 has a fixed 128-bit key with no larger variant. Grover's algorithm gives a quadratic speedup against symmetric key search, so the headline figure is ~64-bit post-quantum security — versus the 128-bit PQ margin you get from a 256-bit key (Camellia-256, ARIA-256, Kuznyechik).
The honest nuance: Grover's search is inherently serial and parallelizes poorly (splitting it across machines only buys a √-factor), so under NIST's MAXDEPTH model the practical attack cost is far above 2⁶⁴. NIST still uses AES-128 as its post-quantum "Level 1" baseline. The real PQ threat is to asymmetric crypto, not to 128-bit symmetric ciphers per se.
Bottom line: SM4's fixed 128-bit key gives you no headroom to grow. For long-term, defense-in-depth data protection, prefer a 256-bit-key cipher where the choice is yours.
SM4 is required for products operating in Chinese markets, including WAPI (Chinese Wi-Fi standard, required for devices sold in China), Chinese banking systems, and government procurement. China's Cryptography Law (2020) mandates OSCCA-approved algorithms for certain categories of data.
The design rationale for SM4's S-box has been partially published but not with the same transparency as AES's design criteria.
If your product is sold or operated in China, SM4 is not a choice — it is a legal requirement. Understanding its structure and limitations (fixed 128-bit key, partial design transparency) is essential for any engineer working in Chinese-regulated markets.
🇷🇺 Exhibit 4 — Kuznyechik
GOST R 34.12-2015 · IETF RFC 7801 (Informational) · not in ISO/IEC 18033-3 — the amendment proposing it was withdrawn over the S-box concerns below
Replaces the older GOST 28147-89 block cipher
Structure: SPN — a 10-round substitution-permutation network
Block size: 128-bit · Key size: 256-bit only
Interactive Encrypt / Decrypt
Kuznyechik's S-box was published without any design rationale. Independent researchers found hidden structure in it — first Biryukov, Perrin and Udovenko (EUROCRYPT 2016), then Léo Perrin's "Partitions in the S-Box of Streebog and Kuznyechik" (IACR ToSC 2019). They showed the S-box has an unusual hidden structure — it can be decomposed in ways that suggest it was not generated randomly, but was constructed using an undisclosed process. The FSB has not responded to these findings.
This is categorically different from:
- AES: S-box derived from multiplicative inverse in GF(2⁸), fully documented
- Camellia: design criteria published, S-box generation explained
- ARIA: involutory S-boxes, construction documented
Use Kuznyechik ONLY when Russian regulatory compliance requires it. The S-box transparency concern is unresolved. For any other use case, AES-256-GCM, Camellia-256, or ARIA-256 are preferable.
Kuznyechik is required by Russian law for government and certain commercial applications. The S-box controversy does not mean it is definitely backdoored — but the lack of design transparency is a meaningful distinction from every other cipher in this demo. Engineers should understand this tradeoff before deployment.
🇺🇦 Exhibit 5 — Kalyna-128/256
DSTU 7624:2014 · not in ISO/IEC 18033-3 · no IETF cipher suite
Replaces GOST 28147-89, the Soviet-era cipher Ukraine had inherited
Structure: SPN — Rijndael-like, but with a wider MDS matrix, four different S-boxes, and pre/post-whitening by addition modulo 2⁶⁴ rather than XOR
Block size: 128 / 256 / 512-bit · Key size: equal to or double the block. Shown here: 128-bit block, 256-bit key, 14 rounds
Interactive Encrypt / Decrypt
The variant shown here takes a 256-bit key, so Grover's quadratic speedup leaves roughly a 128-bit post-quantum margin — the comfortable case, the same as Camellia-256, ARIA-256 and Kuznyechik. Kalyna also defines 256- and 512-bit block sizes, which no other cipher in this demo offers; a wider block pushes out the birthday bound on how much data one key may safely encrypt, which is a different problem from key search and is not something a bigger key fixes.
Until 2015 Ukraine's main block cipher was GOST 28147-89 — a Soviet standard it shared with Russia. Kalyna was chosen to replace it through an open competition explicitly modelled on AES and NESSIE, and the specification was published in English by its own authors. Sovereign cryptography here is a move away from an inherited dependency rather than toward a new one.
Practically, that openness is the asymmetry worth noticing: Kalyna's design rationale and S-box construction are documented, but the cipher has attracted far less independent cryptanalysis than AES, because far fewer people have had a reason to attack it.
Kalyna is required for Ukrainian state information systems and for products certified there. It is also the clearest example in this demo of a national standard adopted for a stated political reason — replacing a cipher inherited from a neighbouring state — rather than because the incumbent was known to be broken.
🇧🇾 Exhibit 6 — BelT-256
STB 34.101.31-2020 (supersedes STB 34.101.31-2011) · not in ISO/IEC 18033-3 · no IETF cipher suite
Structure: 8 rounds over four 32-bit words, each round applying G₅ / G₁₃ / G₂₁ — one 8-bit S-box H applied bytewise, then a 32-bit rotation — mixed with addition modulo 2³² and XOR
Block size: 128-bit · Key size: 128 / 192 / 256-bit, with shorter keys expanded to the 256-bit key the block cipher itself takes
Interactive Encrypt / Decrypt
BelT's block cipher always consumes a 256-bit key. A 128- or 192-bit BelT key is not a smaller cipher — it is expanded into those 256 bits by a fixed, public rule. Expansion adds length, not entropy: a 128-bit BelT key still has 128 bits of entropy, so Grover leaves it the same ~64-bit headline margin that SM4 and SEED have, despite the 256-bit key schedule.
The 256-bit key used here is the one the standard's own test vector uses and the only one with a full 128-bit post-quantum margin. This is a good habit to carry elsewhere: when a spec says a key is "expanded", check whether the expansion is keyed or merely deterministic before crediting it with any security.
STB 34.101.31 is mandatory for Belarusian state information systems and for certified cryptographic protection sold there. The standard is introduced by the Operational and Analytical Centre, the same presidential body that holds broad authority over Belarusian internet infrastructure — so the agency that mandates the cipher and the agency that regulates the network are one.
Unlike Kuznyechik, BelT carries no specific published concern about its S-box or its design, and nothing here should be read as implying one. What it carries is thin external scrutiny: the standard is published, but it has seen a small fraction of the independent cryptanalysis that AES, Camellia or even SM4 have attracted. Absence of published attacks on a cipher few people have attacked is weak evidence.
BelT is the clearest illustration in this demo of the difference between unbroken and well-studied. Both Camellia and BelT are unbroken; only one of them has survived two decades of people being paid to try. If your threat model includes a well-resourced adversary, that distinction is the whole decision.
🇰🇷 Exhibit 7 — SEED
TTAS.KO-12.0004 · ISO/IEC 18033-3 · IETF RFC 4269 (Informational, the algorithm) and RFC 4162 (Standards Track, the TLS cipher suites)
Structure: 16-round Feistel network, two 8×8 S-boxes, mixing XOR with modular addition
Block size: 128-bit · Key size: 128-bit only
Korea's older national cipher — ARIA (Exhibit 2) came five years later and did not replace it
Interactive Encrypt / Decrypt
This is the one panel here driven in CBC rather than ECB, because CBC is what KISA's reference distribution exposes — and CBC is what Korean deployments actually ran. The IV gets its own field, exactly as in Camellia's CBC row. The known-answer test in the panel above still checks SEED's raw block, by a separate route.
SEED has a fixed 128-bit key with no larger variant, so it sits exactly where SM4 does: Grover's quadratic speedup puts the headline figure at ~64-bit post-quantum security, versus the 128-bit margin a 256-bit key gives you.
The same honest nuance applies: Grover's search parallelizes poorly, so under NIST's MAXDEPTH model the practical cost is far above 2⁶⁴, and NIST still uses AES-128 as its post-quantum "Level 1" baseline. The real post-quantum emergency is in asymmetric crypto.
Bottom line: like SM4, SEED gives you no room to grow. Korea's own answer to that was ARIA, which offers 192- and 256-bit keys — which is a large part of why ARIA exists at all.
SEED is a competent cipher that did real damage, and not through its cryptography. Korea mandated it for online banking and e-commerce from the late 1990s, but no mainstream browser implemented it. RFC 4162 added SEED cipher suites to TLS in 2005 — seven years after the cipher — and browsers largely never shipped them.
So Korean sites delivered SEED through a Microsoft ActiveX plug-in instead. ActiveX ran only on Internet Explorer on Windows, which pinned the entire Korean consumer web to one browser on one operating system for well over a decade, normalised "install this binary to use your bank", and left users worse off than plain TLS would have. Unwinding it became explicit government policy from 2015 onward.
The lesson is not "don't build a national cipher." It is that a cipher with no path into the protocols people actually use will be carried by whatever hack is available — and that hack, not the cipher, becomes your real attack surface. Compare Camellia and ARIA, which both got TLS cipher suites and shipped normally.
SEED is still permitted in Korean systems and still appears in legacy financial software, so engineers working on Korean integrations meet it. Treat it the way you would any 128-bit-key, no-AEAD-mode legacy cipher: fine to interoperate with, not what you would choose for new data at rest.
🌊 Exhibit 8 — The Avalanche Effect
A core requirement of any strong block cipher: flipping a single bit of input should change about half of the output bits, unpredictably. This is the avalanche effect (strict avalanche criterion). It's why ciphertext looks like noise and why you can't chip away at a block cipher one bit at a time. All seven ciphers here exhibit it.
Flip One Bit, Watch Half the Ciphertext Change
Each cell is one of the 128 ciphertext bits. Highlighted cells flipped versus the original. A good cipher lands near 64/128 (≈50%) no matter which input bit you change — try a few.
🧩 Exhibit 9 — Why Mode Matters: ECB vs CBC
A strong cipher is not enough — how you chain blocks together matters just as much. ECB (Electronic Codebook) encrypts every 16-byte block independently, so identical plaintext blocks produce identical ciphertext blocks. That leaks structure. CBC chains each block into the next with an IV, so repetition disappears. This is the famous "ECB penguin" problem, shown here on raw blocks.
Encrypt Three Identical Blocks
The plaintext below is the same 16-byte block repeated three times. Watch what each mode does.
ECB — blocks encrypted independently
CBC — blocks chained with an IV
The Actual "ECB Penguin": Encrypt a Picture
Hex rows prove the leak; a picture makes it unforgettable. Below is a small image encrypted with a real block cipher two ways. In ECB, identical plaintext blocks (flat regions of the image) become identical ciphertext blocks, so the ghost of the original shows through. In CBC, chaining destroys the pattern and the same image turns to noise. Same cipher, same key — only the mode differs.
Each canvas renders real pixel bytes: the middle one is those bytes encrypted block-by-block in ECB, the right one in CBC. Nothing is faked — the ECB ghost is the cipher genuinely leaking the image's repeated blocks.
ECB is offered in Exhibit 1 strictly to make this failure visible. Production systems use an authenticated mode such as AES-256-GCM (or Camellia/SM4 in GCM). It hides block structure and detects tampering — ECB and even raw CBC do neither.
📊 Exhibit 10 — Seven-Way Comparison
Comparison Table
| Property | Camellia-256 | ARIA-256 | SM4 | Kuznyechik | Kalyna-128/256 | BelT-256 | SEED |
|---|---|---|---|---|---|---|---|
| Country | Japan | South Korea | China | Russia | Ukraine | Belarus | South Korea |
| Designer | NTT / Mitsubishi | NSRI Korea | OSCCA | FSB Russia | National competition / SSSCIP | BSU research institute / OAC | KISA |
| Year | 2000 | 2003 | 2006 | 2015 | 2015 | 2011 | 1998 |
| Block size | 128-bit | 128-bit | 128-bit | 128-bit | 128-bit (also 256, 512) | 128-bit | 128-bit |
| Key sizes | 128 / 192 / 256 | 128 / 192 / 256 | 128 only | 256 only | 128 / 256 / 512 (= or 2x block) | 128 / 192 / 256 (expanded to 256) | 128 only |
| Structure | Feistel + SPN | SPN | Feistel | SPN | SPN | ARX + S-box, 8 rounds | Feistel |
| ISO/IEC 18033-3 | ✓ | ✗ | ✓ Amd 1:2021 | ✗ withdrawn | ✗ | ✗ | ✓ |
| TLS cipher suite (RFC) | ✓ 5932 | ✓ 6209 | ✓ 8998 (TLS 1.3) | ✓ 9189 (TLS 1.2) | ✗ none | ✗ none | ✓ 4162 |
| IETF status | Standards Track | Informational | Informational | Informational (not endorsed) | No RFC | No RFC | Standards Track (TLS) |
| Design transparency | ✓ Full | ✓ Full | Partial | ✗ S-box opaque | ✓ Full | ✓ Published | ✓ Full |
| PQ security (128-bit key) | ✓ | ✓ | ✗ (64-bit PQ) | ✓ | ✓ | ✓ (at 256-bit key) | ✗ (64-bit PQ) |
| Use when | AES alternative | Korean compliance | China compliance | Russian compliance | Ukrainian compliance | Belarusian compliance | Korean legacy interop |
| Trust level | High | High | Medium | Use with caution | High design, thin review | Thin external review | Sound but dated |
Decision Tree
Camellia, ARIA, SM4 and Kuznyechik also appear in crypto-compare. This demo covers the practical encrypt/decrypt behavior. For deeper algorithm reference including security estimates, see: systemslibrarian.github.io/crypto-compare/