Tutorial 2.7: Block Cipher Modes of Operation

Learning Objectives

After completing this tutorial, you should be able to:

• Explain why block cipher modes are necessary for encrypting data of arbitrary length.
• Describe the operation of each major mode: ECB, CBC, CFB, OFB, CTR, and GCM.
• Analyze the security properties, advantages, and limitations of each mode.
• Identify the types of attacks that each mode resists or is vulnerable to.
• Explain the concept of authenticated encryption and the role of GCM and CCM.
• Compare modes in terms of performance, parallelism, and suitability for different applications.
• Evaluate mode selection for real-world scenarios (e.g., disk encryption, network protocols).
• Apply knowledge of modes to analyze protocol security and design secure systems.

Overview

A block cipher such as AES or DES encrypts fixed-size blocks of data (128 bits for AES, 64 bits for DES). However, real-world data comes in arbitrary lengths—a file may be 10 KB, a network packet 1500 bytes, or a message just 8 bytes. Moreover, encrypting identical plaintext blocks with the same key produces identical ciphertext blocks, which can leak information. Block cipher modes of operation address these issues by defining how to apply the block cipher repeatedly to encrypt data of any length while ensuring that identical plaintext blocks do not produce identical ciphertext.

Modes of operation provide different security properties and performance characteristics. Some modes provide only confidentiality (e.g., ECB, CBC, CTR), while others provide both confidentiality and authenticity (e.g., GCM, CCM). Some modes support parallel encryption (CTR, GCM), while others require sequential processing (CBC, CFB, OFB).

In this tutorial, we will examine each major mode in detail, with diagrams, equations, and worked examples. We'll analyze their security properties, identify vulnerabilities, and discuss their use in real-world systems. By the end, you'll be able to select the appropriate mode for any application.

Relationship to the Tutorial Series

In Tutorials 2.4–2.6, we studied symmetric encryption algorithms (DES, AES). This tutorial shows how those algorithms are actually used in practice. Tutorial 2.8 will cover random number generation and key management, which are closely related to modes like CTR that require nonces.

The Need for Modes of Operation

Limitations of the Basic Block Cipher

A block cipher alone (often called "raw" encryption) has several limitations:

1. Fixed block size: Data lengths rarely match the block size exactly. Padding is needed, but padding alone doesn't solve the other issues.
2. Deterministic encryption: The same plaintext block always encrypts to the same ciphertext block with the same key, revealing patterns.
3. No integrity: The block cipher provides confidentiality but no protection against modification or forgery.

Goals of Modes of Operation

• Length flexibility: Encrypt messages of any length.
• Pattern hiding: Ensure that identical plaintext blocks (or identical messages) produce different ciphertext.
• Randomization: Use initialization vectors (IVs) or nonces to ensure different outputs for the same plaintext.
• Error propagation control: Define how errors in transmission affect the decrypted plaintext.
• Authenticity: Some modes provide message authentication, ensuring integrity and authenticity.

Electronic Codebook (ECB)

ECB is the simplest mode: each plaintext block is encrypted independently with the same key.

C_i = E_K(P_i)

P_i = D_K(C_i)

Figure 1: Electronic Codebook (ECB) mode.

Advantages

• Parallelizable: Each block can be encrypted/decrypted independently.
• Simple: Easy to implement.
• Error resilience: A transmission error in one block does not affect other blocks.

Vulnerabilities

• Pattern leakage: Identical plaintext blocks produce identical ciphertext blocks, revealing patterns (e.g., in images, repeated areas appear as repeated ciphertext).
• Deterministic: No randomization; the same message always encrypts the same way.
• Malleability: Ciphertext blocks can be rearranged, duplicated, or removed without detection.

Cipher Block Chaining (CBC)

CBC chains blocks together by XORing each plaintext block with the previous ciphertext block before encryption. An initialization vector (IV) is used for the first block.

C_i = E_K(P_i ⊕ C_i−1), with C₀ = IV

P_i = D_K(C_i) ⊕ C_i−1

Figure 2: Cipher Block Chaining (CBC) mode.

IV Requirements

• The IV must be random and unpredictable for each encryption operation.
• The IV need not be secret; it is typically transmitted with the ciphertext.
• Reusing the IV with the same key leaks information (the XOR of two plaintexts becomes known).

Properties

• Pattern hiding: Identical plaintext blocks produce different ciphertext because of chaining.
• Error propagation: A bit error in C_i affects the decryption of C_i (corrupting the entire block) and C_i+1 (corrupting one bit at the corresponding position).
• Sequential: Encryption cannot be parallelized (each block depends on the previous ciphertext). Decryption can be parallelized because the blocks are independent for decryption (except for the XOR with previous ciphertext).

Padding

CBC requires padding to make the plaintext length a multiple of the block size. PKCS#7 (and the earlier PKCS#5) define padding: pad with n bytes of value n, where n = block_size − (data_length mod block_size). For AES, the block size is 16 bytes, so n ranges from 1 to 16.

Vulnerabilities

• Padding oracle attacks: If the system reveals whether padding is valid, an attacker can decrypt ciphertext block by block (e.g., POODLE, Lucky Thirteen).
• IV reuse: Reusing the same IV with the same key leaks information.
• Chosen ciphertext attacks: CBC is vulnerable to certain chosen-ciphertext attacks if the IV is predictable.

Cipher Feedback (CFB)

CFB turns a block cipher into a stream cipher. It encrypts the previous ciphertext block and XORs the result with the plaintext to produce the ciphertext.

CFB can operate on r-bit units (where r ≤ block size). For the common case r = block size:

C_i = P_i ⊕ E_K(C_i−1), with C₀ = IV

P_i = C_i ⊕ E_K(C_i−1)

Figure 3: Cipher Feedback (CFB) mode (r = block size).

Properties

• Stream cipher behavior: No padding required; can encrypt data of any length.
• Encryption uses E only: Decryption also uses E (not D), which is convenient if hardware supports only encryption.
• Error propagation: A bit error in C_i affects decryption of C_i and subsequent blocks until the error shifts out of the feedback register.
• Sequential: Cannot be parallelized (each block depends on the previous).

CFB with r < Block Size

CFB can operate on smaller units (e.g., 1 bit, 8 bits). The feedback register holds the last ciphertext block, and only the top r bits are used. This allows encryption of streaming data with low latency but is less efficient for large data.

Output Feedback (OFB)

OFB also turns a block cipher into a stream cipher, but unlike CFB, it generates the keystream independently of the plaintext. The block cipher encrypts the previous output to produce the next keystream block.

O₀ = IV

O_i = E_K(O_i−1)

C_i = P_i ⊕ O_i

P_i = C_i ⊕ O_i

Figure 4: Output Feedback (OFB) mode.

Properties

• Stream cipher: No padding required.
• Error propagation: A bit error in ciphertext affects only the corresponding plaintext bit.
• Keystream independence: The keystream depends only on the key and IV, not on plaintext or ciphertext.
• IV uniqueness: The IV (O₀) must be unique for each encryption with the same key. If the same IV is used, the same keystream is generated.
• Keystream period: For AES with a 128-bit block, the period is long (2¹²⁸), but the keystream will eventually repeat.

Limitations

• IV reuse: Reusing the IV with the same key compromises confidentiality (XOR of plaintexts is revealed).
• No authentication: OFB provides confidentiality only.
• Sequential: Cannot be parallelized (keystream generation is sequential).

Counter Mode (CTR)

CTR mode uses a counter that is incremented for each block. The counter is encrypted to produce a keystream block, which is then XORed with the plaintext.

CTR_i = (nonce || counter)

O_i = E_K(CTR_i)

C_i = P_i ⊕ O_i

P_i = C_i ⊕ O_i

Figure 5: Counter (CTR) mode.

Properties

• Parallelizable: Each block can be encrypted/decrypted independently.
• Random access: Any block can be decrypted without decrypting previous blocks.
• No padding: Works with data of any length.
• High performance: Pre-computation of keystream is possible.
• Error propagation: A bit error in ciphertext affects only the corresponding plaintext bit.

Counter Management

• Nonce: A unique value for each encryption with the same key. The nonce can be a random number or a counter.
• Counter: Increments for each block. Must not repeat within the same nonce.
• Collision risk: If the same (nonce, counter) pair is used with the same key, the keystream repeats, compromising confidentiality.
• Standard: NIST SP 800-38A specifies CTR mode.

Advantages Over Other Modes

• Parallelism: CTR is the only mode (besides GCM) that is fully parallelizable for both encryption and decryption.
• No padding oracle vulnerabilities: Unlike CBC, CTR is not vulnerable to padding oracle attacks.
• Pre-computation: Keystream blocks can be pre-computed for efficiency.

Galois Counter Mode (GCM)

GCM is an authenticated encryption mode that combines CTR mode for confidentiality with a Galois hash for authentication. It provides both confidentiality and integrity/authenticity in a single pass.

GCM uses:

• CTR mode for encryption (with a unique IV).
• Galois field multiplication (in GF(2¹²⁸)) to compute an authentication tag over the ciphertext and additional authenticated data (AAD).

Figure 6: Galois Counter Mode (GCM) – high-level structure.

GCM Components

• IV (Initialization Vector): Must be unique for each encryption with the same key. Usually 96 bits is recommended.
• Additional Authenticated Data (AAD): Data that is authenticated but not encrypted (e.g., headers).
• Authentication Tag: A fixed-length tag (typically 128 bits, but can be shorter) that provides integrity and authenticity.
• GHASH: A universal hash function based on multiplication in GF(2¹²⁸).

Properties

• Authenticated encryption: Provides both confidentiality and authenticity.
• Parallelizable: Both encryption and authentication can be parallelized.
• High performance: Efficient in hardware (AES-GCM is accelerated in AES-NI).
• No padding: Works with data of any length.

Security Considerations

• IV uniqueness: Reusing an IV with the same key breaks both confidentiality and integrity (the GHASH key can be recovered).
• Tag length: Longer tags provide stronger authentication. NIST recommends 96, 104, or 112 bits for some applications; 128 bits is optimal.
• Nonce size: With 96-bit IVs, up to 2³² messages can be encrypted with the same key (the counter wraps after 2³² blocks).

Authenticated Encryption Modes

Authenticated encryption (AE) modes combine confidentiality and authentication in a single operation, providing both secrecy and integrity/authenticity. This is essential for secure protocols because encryption alone does not protect against tampering.

Common AE Modes

Why Authenticated Encryption Matters

• Confidentiality alone is insufficient: Without integrity, an attacker can modify ciphertext and cause undetectable changes to plaintext (e.g., changing a transaction amount).
• Encrypt-then-MAC vs. EtA: AE combines encryption and authentication in a single pass, reducing complexity and the risk of implementation errors.
• Standardization: NIST has standardized GCM and CCM (SP 800-38C and SP 800-38D).

Comparison and Selection Guide

Mode Comparison Table

Selection Guidelines

Implementation Considerations

IV/Nonce Management

• CBC: IV must be random and unpredictable. If the IV is predictable, the cipher is vulnerable to chosen-plaintext attacks.
• CTR: Nonce must be unique for each encryption. A common approach is to use a counter (e.g., starting at 1 and incrementing).
• GCM: IV must be unique; 96-bit IVs are recommended. If the IV repeats, the GHASH key can be recovered.
• OFB: IV must be unique; using a counter ensures uniqueness.
• CFB: IV must be unique and unpredictable.

Performance Characteristics

• ECB: Fastest (parallel), but insecure.
• CBC: Fast encryption (serial), decryption can be parallelized. Padding overhead.
• CTR: Fast and parallelizable. No padding.
• GCM: Slightly slower than CTR (due to GHASH), but provides authentication. Hardware acceleration (AES-NI) makes it very fast.

Security Considerations

• Padding oracle: CBC is vulnerable to padding oracle attacks if the system reveals padding validity. Use CTR or GCM to avoid this.
• IV reuse: Never reuse an IV/nonce with the same key in any mode. This is a fatal flaw in CTR, GCM, and OFB.
• Authentication: If using a confidentiality-only mode (CBC, CTR, CFB, OFB), always combine with a MAC (e.g., HMAC) to provide integrity.
• Tag length: For GCM, use 128-bit tags for maximum security. Shorter tags reduce security against forgery attacks.

Case Study: Mode Selection in Practice

TLS 1.3

TLS 1.3 (RFC 8446) mandates authenticated encryption. The only cipher suites are AEAD (Authenticated Encryption with Associated Data) suites:

• AES-GCM (128 or 256-bit keys): Primary choice.
• ChaCha20-Poly1305: Alternative for systems without AES-NI.
• AES-CCM: Optional, for constrained environments.

TLS 1.3 does not support CBC, ECB, or any mode without authentication. This eliminates many vulnerabilities from earlier TLS versions (e.g., POODLE, Lucky Thirteen).

Disk Encryption (BitLocker, LUKS)

Disk encryption uses modes designed for storage:

• XTS-AES: A mode specifically designed for disk encryption. It uses a tweak (sector number) to ensure that the same plaintext in different sectors encrypts differently.
• Why not GCM? GCM's authentication is not needed for disk encryption (the entire disk is considered the ciphertext), and XTS provides better performance and random access for disk operations.

Wi-Fi (WPA2)

WPA2 uses the CCMP (CCM Protocol) for encryption, which is based on AES-CCM (Counter with CBC-MAC). This provides authenticated encryption for Wi-Fi traffic.

SSH

SSH supports multiple modes, including AES-GCM (recommended), AES-CTR, and AES-CBC. The default is often AES-GCM in modern implementations.

Key Takeaways

Section Summaries

• ECB: Simple but insecure for most applications due to pattern leakage. Never use for anything other than single-block operations.
• CBC: Provides pattern hiding with chaining. Requires random IV and padding. Vulnerable to padding oracle attacks.
• CFB: Stream cipher mode. Uses encryption only. Self-synchronizing with r < block size.
• OFB: Stream cipher mode with keystream independent of plaintext. Requires unique IV. Sequential.
• CTR: Parallelizable stream cipher mode. No padding. Requires unique nonce/counter pair. Used in GCM.
• GCM: Authenticated encryption mode combining CTR and GHASH. Provides confidentiality and integrity. Parallelizable. The recommended mode for new systems.
• Authenticated Encryption: Essential for secure protocols. Avoids the "encrypt then MAC" pitfalls.
• Selection: Choose based on requirements (parallelism, authentication, latency, legacy compatibility).

Quiz

1. What is the main security vulnerability of ECB mode?
Answer
ECB mode produces identical ciphertext for identical plaintext blocks, revealing patterns in the plaintext. This makes it insecure for most applications (e.g., encrypting images, data with repeated patterns).
2. What is the role of the IV in CBC mode?
Answer
The IV (initialization vector) randomizes the encryption so that identical plaintexts produce different ciphertexts. It is XORed with the first plaintext block before encryption. The IV must be random and unpredictable.
3. How does CTR mode achieve parallelism?
Answer
CTR mode encrypts a counter value for each block independently. Since the counter values are known in advance and the encryption of each counter block is independent, all blocks can be encrypted and decrypted in parallel.
4. What is the difference between OFB and CFB modes?
Answer
In OFB, the keystream is generated independently of the plaintext and ciphertext (feedback from the block cipher output). In CFB, the feedback comes from the ciphertext (previous ciphertext block). OFB does not propagate errors; CFB does.
5. What is authenticated encryption, and why is it important?
Answer
Authenticated encryption provides both confidentiality (encryption) and authenticity/integrity (message authentication) in a single operation. It is important because encryption alone does not protect against tampering or forgery.
6. Which mode is used in TLS 1.3, and why?
Answer
TLS 1.3 mandates authenticated encryption modes such as AES-GCM and ChaCha20-Poly1305. This eliminates vulnerabilities from earlier TLS versions that used CBC without proper authentication.
7. What happens if the same IV/nonce is used twice with the same key in CTR mode?
Answer
The same keystream is generated for both encryptions. XORing the two ciphertexts reveals the XOR of the two plaintexts, which can allow an attacker to recover the plaintexts if one is known.
8. What is the padding oracle attack, and which mode is vulnerable to it?
Answer
A padding oracle attack exploits the fact that the system reveals whether the padding is valid after decryption. This allows an attacker to decrypt ciphertext block by block. CBC mode is vulnerable when combined with PKCS#7 padding and an oracle that distinguishes valid padding.
9. What are the components of GCM mode?
Answer
GCM combines CTR mode for confidentiality with GHASH (a universal hash function in GF(2¹²⁸)) for authentication. It also supports Additional Authenticated Data (AAD) that is authenticated but not encrypted.
10. What mode is recommended for disk encryption, and why?
Answer
XTS-AES is recommended for disk encryption because it provides random access (each sector is encrypted independently) and uses a tweak (sector number) to ensure that the same plaintext in different sectors encrypts differently.

Exercises

1. CBC Encryption

   For CBC mode with AES (block size 16 bytes), suppose the IV is 0x000102030405060708090A0B0C0D0E0F and the plaintext is the single block 0x101112131415161718191A1B1C1D1E1F. The key K produces E_K(IV ⊕ P) = 0xAABBCCDDEEFF00112233445566778899. What is the ciphertext?

Sample Solution

C = E_K(P ⊕ IV)

P ⊕ IV = 0x101112131415161718191A1B1C1D1E1F ⊕ 0x000102030405060708090A0B0C0D0E0F = 0x10101010101010101010101010101010

C = E_K(0x10101010101010101010101010101010) = 0xAABBCCDDEEFF00112233445566778899

2. CTR Mode Calculation

   For CTR mode with AES (block size 16 bytes), the nonce is 0x00000000 and the counter starts at 0x00000001. What is the keystream block for counter value 0x00000001? (Assume E_K(0x00000000000000000000000000000001) = 0x1234567890ABCDEF1234567890ABCDEF). Encrypt the plaintext block 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF.

Sample Solution

CTR value = nonce || counter = 0x00000000 00000000 00000000 00000001

Keystream = E_K(CTR) = 0x1234567890ABCDEF1234567890ABCDEF

Ciphertext = P ⊕ Keystream = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF ⊕ 0x1234567890ABCDEF1234567890ABCDEF = 0xEDCBA9876F543210EDCBA9876F543210

3. ECB vs. CBC Pattern Leakage

   Consider a plaintext with 8 identical blocks. In ECB mode, what would the ciphertext look like? In CBC mode, what would the ciphertext look like? Explain why CBC hides patterns better.

Sample Solution

ECB: All 8 ciphertext blocks are identical because each plaintext block encrypts the same way: C₁ = C₂ = ... = C₈.

CBC: The first block is C₁ = E(P₁ ⊕ IV). The second block is C₂ = E(P₂ ⊕ C₁), and so on. Even though P₂ = P₁, the input to the block cipher is different because of the chaining, so the ciphertext blocks are different. This hides patterns.

4. GCM Authentication

   In GCM mode, what is the role of the Additional Authenticated Data (AAD)? Give an example of when AAD would be useful.

Sample Solution

AAD is data that is authenticated (protected against tampering) but not encrypted. It is included in the GHASH computation to ensure its integrity. Example: In a network packet, the IP header and TCP/UDP header may need to be authenticated but not encrypted (to allow routing and processing). AAD allows the receiver to verify that these fields have not been modified.

5. Mode Selection Scenario

   You are designing a secure messaging application that needs to encrypt 1 KB messages. The messages are sent over a network with high latency and limited bandwidth. Which mode would you recommend, and why?

Sample Solution

Recommendation: AES-GCM.

Rationale: GCM provides authenticated encryption, ensuring both confidentiality and integrity. It is parallelizable, which allows efficient use of multi-core processors. It does not require padding, saving bandwidth. The authentication tag ensures that messages are not tampered with. Since the messages are relatively small, the overhead of GCM is acceptable.

Alternative: AES-CTR with an independent HMAC (if GCM is not available), but GCM is preferred for its single-pass efficiency.

Homework

1. Research: Padding Oracle Attacks

   Research the padding oracle attack (e.g., POODLE, Lucky Thirteen). Write a 500-word report that explains:

   • How the attack works (the oracle and the decryption process).
   • Which modes are vulnerable and why.
   • How to mitigate the attack (e.g., using authenticated encryption).
Sample Answer

Complete answer would describe the padding oracle attack as an adaptive chosen-ciphertext attack where the attacker sends modified ciphertexts and observes whether the padding is valid. It exploits the fact that CBC mode with PKCS#7 padding reveals padding validity. The attack allows decryption of arbitrary ciphertext blocks. Mitigations include using authenticated encryption (GCM, CCM), using CTR mode (no padding), or using constant-time padding checks.

2. Compare AE Modes

   Compare GCM, CCM, and EAX modes of operation. Create a table showing:

   • Confidentiality mechanism
   • Authentication mechanism
   • Parallelizability
   • IV/nonce requirements
   • Performance characteristics
   • Standardization status
Sample Answer

A complete answer would include a table with the requested information. GCM uses CTR + GHASH, is parallelizable, requires unique IV, and is NIST-standardized. CCM uses CBC-MAC + CTR, has limited parallelizability, requires unique nonce, and is NIST-standardized. EAX uses CTR + CMAC, is parallelizable, requires unique nonce, and is not NIST-standardized but is widely supported.

3. XTS-AES Analysis

   Research XTS-AES mode (used for disk encryption). Write a summary that addresses:

   • How XTS works and its key structure (tweak key and data key).
   • Why GCM is not suitable for disk encryption.
   • The security properties of XTS (confidentiality, not authentication).
Sample Answer

Complete answer would explain that XTS-AES uses a tweak (sector number and block offset) to encrypt each sector independently. It has two keys: a tweak key for the encryption of the tweak and a data key for the encryption of the data. GCM is not suitable because disk encryption requires random access and the authentication tag would need to be stored separately. XTS provides confidentiality but no authentication (disk integrity is handled at a higher layer).

4. CTR Nonce Management

   Design a nonce management scheme for CTR mode with a 128-bit key and a 96-bit nonce. Consider:

   • How to ensure nonce uniqueness across multiple sessions.
   • How to handle counter overflow (2³² blocks).
   • The trade-off between nonce size and counter size.
Sample Answer

A complete answer would propose using a 96-bit nonce that is a combination of a per-session random value and a monotonic counter. The counter would be 32 bits (allowing 2³² blocks per nonce). If the counter overflows, a new nonce must be generated. Alternatively, use a 64-bit nonce and 64-bit counter for larger messages. The key point is that the (nonce, counter) pair must be unique for each block.

5. Mini-Project: Implement CTR and GCM

   Implement AES-CTR and AES-GCM encryption/decryption in your preferred language (using a library or custom implementation). Test with NIST test vectors. Compare the performance and code complexity of the two modes. Write a report on your findings.

Sample Answer

Complete answer would include source code, test results (passing NIST vectors), performance measurements, and a discussion of the additional complexity of GCM (GHASH) compared to CTR. Observations might include that CTR is simpler to implement but GCM provides authentication "for free" with little additional overhead.

Summary

This tutorial has provided a comprehensive examination of block cipher modes of operation. We began by explaining why modes are necessary: block ciphers operate on fixed-size blocks, but real-world data comes in arbitrary lengths, and deterministic encryption reveals patterns.

We examined the major modes in detail:

• ECB: Simple but insecure due to pattern leakage. Should not be used.
• CBC: Provides pattern hiding with chaining. Requires a random IV and padding. Vulnerable to padding oracle attacks.
• CFB: Stream cipher mode that uses encryption only. Self-synchronizing.
• OFB: Stream cipher mode with keystream independent of plaintext. Requires unique IV.
• CTR: Parallelizable stream cipher mode. No padding. Requires unique nonce/counter pair.
• GCM: Authenticated encryption mode combining CTR and GHASH. Provides confidentiality and integrity. The recommended mode for most new systems.

We discussed authenticated encryption and its importance for secure protocols, and we compared modes across dimensions such as parallelism, authentication, and IV requirements. We also considered implementation considerations, including IV/nonce management and performance.

The case studies illustrated mode selection in practice: TLS 1.3 uses GCM, disk encryption uses XTS-AES, and Wi-Fi uses CCM. These real-world examples show how the theoretical properties of modes translate into practical choices.

With this knowledge, you can now select the appropriate mode for any application and understand the security implications of your choice.

Connection to the Next Tutorial

In Tutorial 2.8: Random Numbers and Key Generation, we will explore the generation of cryptographic keys and random numbers—essential components for IVs, nonces, and key material. The security of many modes (especially CTR, GCM, and CBC) depends on the quality of randomness, making this an important follow-up topic.