What makes an open source encryption algorithm safe? Take for example the popular AES algorithm where we have a combination of substitution, shift row, mix column, and add key steps involved in encrypting plain test.

All of the mathematical operations within the s-boxes, shift row, and mix column should be known to the attacker, correct? I understand they could be hard to calculate but aren't they static operations for the most part? Since they can literally see the implementation of the calculations in the code to see how all the bits were changed around. The only step that is therefore hard to break is the add key stage, where we XOR our key with blocks of bytes.

The XOR state is irreversible without the proper key which is what I understand, so whats the point of all of the other operations that happen on the key? Since the implementation details are known of how the substitution, shift row, and mix column steps work, whats the point of using them in the encryption scheme?
The XOR state is irreversible without the proper key which is what I understand, so whats the point of all of the other operations that happen on the key?


Suppose all we had was secret keys and the XOR operation.  Well, actually, it is possible to build a secure cipher out of that, called the one time pad.  One time pads offer perfect secrecy, but suffer from fatal practical flaws:


The keys must be as long as the messages.
You must never use the same key to encrypt two different messages, or it becomes very easy to break.


So we can look at your question from this angle: the extra complexity in modern ciphers is the price that we pay to remove those practical disadvantages.  It's what allows us to use a single 128-bit key to safely encrypt gigabytes of data, time and time again.

The other thing that I'd highlight is this: you're assuming that just because you know what operations an algorithm does, it's automatically easy to undo those operations.  But one of the core assumptions of modern cryptography is that this is false: there are operations that are easy to do but costly to undo.  The prime example is that multiplication is easy (runs in polynomial time), but factorization is costly (doesn't run in polynomial time).  It's possible to prove that, if such one-way functions exist, then cryptographic algorithms can be built and fully disclosed, whose security depends exclusively on the secrecy of the key.

So if the designers of AES chose their operations right, then AES encryption and decryption are:


Easy for parties who know the secret key;
Costly for parties who don't.


Whether this is true for actual algorithms like AES and why, well, that is the hard part, and can't be answered in a brief question/answer format like this.