AES Encryption Explained

The Advanced Encryption Standard (AES) is a symmetric-key block cipher adopted by the U.S. National Institute of Standards and Technology (NIST) as Federal Information Processing Standard (FIPS) 197 in November 2001. AES encrypts data in fixed-size 128-bit blocks using a secret key of 128, 192, or 256 bits. It is the most widely deployed encryption algorithm in the world, securing everything from classified government communications to the HTTPS connection you use to browse the web.

AES is a symmetric cipher, meaning the same key is used for both encryption and decryption. This distinguishes it from asymmetric algorithms like RSA, which use a public key for encryption and a private key for decryption. Symmetric encryption is orders of magnitude faster than asymmetric encryption, making AES the practical choice for encrypting large volumes of data such as disk images, backup files, and full-disk encryption.

The strength of AES lies in its mathematical foundation, its resistance to all known cryptanalytic attacks, and its efficiency in both software and hardware implementations. No practical attack against AES has been demonstrated since its adoption over two decades ago. The best known theoretical attack against AES-256 reduces the effective key strength from 2^256 to 2^254.4 operations — still a number so astronomically large that it would take longer than the age of the universe to brute-force using all the computing power on Earth.

Macrium Reflect integrates AES encryption directly into the backup pipeline, encrypting data as it is read from the source disk before it is written to the backup image file. This inline encryption approach ensures that plaintext data never touches the backup destination — there is no temporary unencrypted file that could be intercepted or recovered from the destination media.

When you enable encryption on a backup definition, Macrium Reflect prompts for a password. This password is not used directly as the encryption key. Instead, Macrium uses PBKDF2 (Password-Based Key Derivation Function 2) to derive a 256-bit encryption key from your password. PBKDF2 applies a pseudorandom function (HMAC-SHA-256) to the password combined with a random salt, repeating the process for a configurable number of iterations. This key stretching serves two critical purposes: it converts a human-memorable password of arbitrary length into a fixed-length cryptographic key, and it dramatically slows down brute-force password guessing attacks by making each guess computationally expensive.

The salt — a random value generated uniquely for each backup image — ensures that identical passwords produce different encryption keys for different backups. This prevents an attacker who obtains multiple encrypted backup images from determining whether they share the same password by comparing the encrypted data. The salt is stored in the backup image header alongside the encryption metadata; it does not need to be kept secret because its purpose is to ensure uniqueness, not confidentiality.

Each backup image in a chain (full, incremental, or differential) is encrypted independently with its own salt and derived key. All images in the chain use the same password, but the actual encryption key differs for each image due to the unique salt. This means that compromising the encryption of one image in the chain does not automatically compromise the others.

One of the most common concerns about enabling backup encryption is the potential impact on backup speed. In the era before hardware-accelerated AES, this concern was legitimate — software AES implementation could reduce backup throughput by 30-50%. Modern hardware has fundamentally changed this equation.

AES-NI (AES New Instructions) is a set of CPU instructions specifically designed to accelerate AES encryption and decryption. Introduced by Intel in 2010 with the Westmere microarchitecture and adopted by AMD in 2011 with the Bulldozer architecture, AES-NI is now present in virtually every x86 processor sold in the last decade. With AES-NI, a single CPU core can encrypt data at speeds exceeding 4 GB/s — significantly faster than most storage devices can read or write data.

In practice, this means that AES-256 encryption is rarely the bottleneck in a backup operation. The limiting factors are typically disk I/O (reading from the source and writing to the destination), network bandwidth (for network or cloud backup targets), and data compression (which is CPU-intensive but runs in parallel with encryption on multi-core processors). Macrium Reflect exploits hardware AES-NI when available, processing encryption in a dedicated pipeline stage that overlaps with disk I/O and compression.

Real-world benchmarks show that enabling AES-256 encryption in Macrium Reflect typically adds 3-10% to backup completion time when writing to a local SSD or NAS, and has no measurable impact when the destination is cloud storage (where upload bandwidth is the dominant constraint). For most users, the security benefit of encryption far outweighs this marginal time increase.

The advent of quantum computing poses a potential future threat to some cryptographic algorithms, but its impact on AES is more nuanced than headlines suggest. Shor's algorithm, which runs on quantum computers, can efficiently factor large numbers and compute discrete logarithms, breaking RSA, Diffie-Hellman, and elliptic curve cryptography. However, Shor's algorithm does not directly apply to symmetric ciphers like AES.

The primary quantum threat to AES is Grover's algorithm, which provides a quadratic speedup for brute-force search. Grover's algorithm effectively halves the key length: AES-256 is reduced to an effective strength of 128 bits, and AES-128 to an effective 64 bits. A 64-bit effective key strength is considered insufficient for long-term security, which is why NIST and the NSA recommend AES-256 for data that must remain secure for decades — including backup archives with long retention periods.

Importantly, building a quantum computer capable of running Grover's algorithm against AES-256 at scale is an engineering challenge of staggering magnitude. Current quantum computers have fewer than 1,500 noisy qubits; running Grover's algorithm against AES-256 would require millions of stable, error-corrected logical qubits. Most cryptographers estimate that quantum computers capable of threatening AES-128 are at least 15-30 years away, and AES-256 may remain secure against quantum attacks for the foreseeable future.

By using AES-256 for backup encryption today, you are already implementing the NIST-recommended quantum-resistant symmetric key length. Your encrypted backup archives are protected against both current classical computers and the anticipated capabilities of future quantum computers.