You're misremembering, twice. There was a story about mysterious S-boxes selected by NSA for DES http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_

You're misremembering, twice. There was a story about mysterious S-boxes selected by NSA for DES http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27.... Those S-boxes turned out to be designed to resist differential attacks, which were only known to NSA at that time. This doesn't count as weakening at all. The difference between AES and Rijndael is only in that AES has a fixed block size of 128 bits and a key size of 128, 192, or 256 bits, whereas Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits and a maximum of 256 bits. (http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_cipher http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#De...)