English
Menu

What is Block cipher mode of operation?

The way the block transformations of a block cipher are combined to encrypt data longer than one block. Examples are ECB, which encrypts each block independently; CBC, which XORs each block with the previous ciphertext block before encrypting it; CTR, which XORs the data with a keystream made by encrypting a counter; and GCM, which adds authentication to CTR. ECB is not used for general data because identical plaintext blocks become identical ciphertext blocks. CBC and CTR require initialization vectors and nonces to be handled correctly.

Japanese name: 暗号利用モード

Block cipher mode of operation appears in 11 practice questions across 1 topic, including Applied Cryptography.

Field: Applied Cryptography

Comparing the main modes

ECB can be processed in parallel but leaves the patterns of the plaintext visible. CBC needs padding, and its encryption cannot be parallelized because each block waits for the result of the previous one, though decryption can. CTR needs no padding, both encryption and decryption can be parallelized, and decryption can start at any position. However, CBC and CTR only encrypt and cannot detect tampering.

Authenticated-encryption modes

GCM and CCM compute an authentication tag while encrypting and can detect tampering. Today's major protocols, such as TLS 1.3, IPsec and the WPA2 and WPA3 wireless LAN security, use modes like these. Combining CBC with a MAC is rarely used in new designs, because getting the combination wrong leads to attacks such as padding oracle attacks.

Disk encryption

Disk and SSD encryption commonly uses XTS mode, which uses a different value for each sector position and produces ciphertext of the same length as the plaintext. Because the size of the storage location cannot change, no authentication tag can be added, so tampering cannot be detected.

Try it: questions about Block cipher mode of operation

Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?

  1. AThe AES key was too short, so some blocks were left as they were without being encrypted
  2. BECB mode automatically generates a different key for each block, and the pattern of those keys appears in the encrypted image
  3. CIn ECB mode identical plaintext blocks always become identical ciphertext blocks, so the patterns of areas of the same color remain
Show answer and explanation

Answer: C. In ECB mode identical plaintext blocks always become identical ciphertext blocks, so the patterns of areas of the same color remain

ECB (electronic codebook) mode simply encrypts each block independently with the same key. So if the plaintext contains blocks with identical contents, identical blocks appear at the same positions in the ciphertext. In an image with long runs of the same color, such as a background, the information about where the same color is remains, and the example of an encrypted penguin image is well known. For this reason ECB mode is not used to encrypt general data; modes that produce a different ciphertext each time even from the same plaintext, such as CBC mode, CTR mode and GCM, are used instead.

Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?

  1. AKeep the IV secret like the key and keep using the same value for every message
  2. BThe IV need not be secret, but choose a new random value for each message that an attacker cannot predict
  3. CThe IV need not be secret, and it may be fixed to the same value agreed with the other party (for example all zeros) every time
Show answer and explanation

Answer: B. The IV need not be secret, but choose a new random value for each message that an attacker cannot predict

In CBC mode each plaintext block is XORed with the previous ciphertext block before being encrypted, and the first block is XORed with the IV. The IV is usually sent at the beginning of the ciphertext, so it need not be kept secret. However, if the same IV is used every time, messages that begin the same way also produce ciphertexts that begin the same way, revealing that parts of the contents are identical. Furthermore, if an attacker can predict the next IV, attacks are known that guess contents by having chosen plaintexts encrypted (such as the BEAST attack on TLS 1.0).

FAQ

Which mode should I choose?

Unless there is a special reason, use authenticated encryption such as AES-GCM or ChaCha20-Poly1305 and make sure nonces never repeat under the same key. Do not use ECB. Using the authenticated encryption that a library provides is less error-prone than combining CBC or CTR with a MAC yourself.

Why does CTR mode need no padding?

CTR mode just XORs the plaintext with a keystream made by the block cipher, so the keystream of the last block can simply be cut to the length of the plaintext. What goes through the block cipher is the counter value, not the plaintext itself.

Block cipher mode of operation in the explanations

Questions that mention Block cipher mode of operation (11)

  1. Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?
  2. Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?
  3. AES (block length 16 bytes) is used in CBC mode with PKCS#7 padding. In PKCS#7, if n bytes are missing, n bytes of value n are added, and even when the plaintext length is exactly a multiple of 16, 16 bytes of value 16 are added. Which of the following is the length of the ciphertext (not including the IV) when a 96-byte plaintext is encrypted?
  4. A server receiving data encrypted in CBC mode returned different errors when the padding after decryption was incorrect and when the padding was correct but the check of the contents failed. Which of the following correctly describes this situation?
  5. Which of the following correctly describes a feature of CTR mode (counter mode) of a block cipher?
  6. In CTR mode, two messages were mistakenly encrypted with the same key and the same nonce. For the byte at one position, the first plaintext P₁ is 01001000 (ASCII "H"), its ciphertext C₁ is 01110100 and the second ciphertext C₂ is 01010101. If the attacker knows P₁, which of the following is the second plaintext P₂ at the same position?
  7. Let 1 GiB = 2³⁰ bytes and 1 EiB = 2⁶⁰ bytes. A block cipher with a 64-bit block (such as 3DES) is used in CBC mode to encrypt a large amount of data under one key. Treating the ciphertext blocks as random 64-bit values, which of the following is the approximate amount of data at which, by the birthday paradox, the probability that a pair of identical ciphertext blocks appears can no longer be ignored?
  8. Which of the following correctly describes the difference between block ciphers and stream ciphers among symmetric-key ciphers?
  9. Which of the following does authenticated encryption (AEAD) such as AES-GCM provide in a single operation?
  10. Which of the following correctly describes the 96-bit nonce (IV) used in AES-GCM?
  11. Which of the following correctly describes a change from TLS 1.2 in TLS 1.3 (RFC 8446)?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Authenticated encryption (AEAD) AES (Advanced Encryption Standard) Nonce TLS Birthday attack Cookie (HTTP cookie) Message authentication code RSA cryptosystem Forward secrecy Diffie–Hellman key exchange

Back to the glossary