Block Cipher Modes

Also Known As

TL;DR

Explanation

Block ciphers encrypt fixed-size blocks. Modes define how blocks relate: ECB (each block encrypted independently — identical plaintext blocks produce identical ciphertext, leaking patterns), CBC (each block XORed with previous ciphertext — requires padding and a separate MAC for integrity), CTR (turns block cipher into stream cipher — no padding, but no authentication), GCM (CTR mode + GHASH authentication — authenticated encryption, no separate MAC needed, parallelisable). AES-256-GCM is the correct choice for new implementations. Nonces/IVs must be unique per encryption.

Common Misconception

Why It Matters

Common Mistakes

• AES-ECB for any structured data — identical 16-byte blocks produce identical ciphertext, leaking structure.
• CBC without MAC (encrypt-then-MAC) — CBC is malleable; an attacker can modify ciphertext without detection.
• Reusing an IV with the same key in GCM — catastrophic; two ciphertexts XOR to reveal both plaintexts.
• Not authenticating the associated data in GCM — headers/metadata can be tampered without invalidating the tag.

Code Examples

// AES-ECB — insecure:
$encrypted = openssl_encrypt($data, 'AES-256-ECB', $key);
// Identical 16-byte blocks encrypt identically
// 'aaaaaaaaaaaaaaaa' encrypts to the same ciphertext every time

// CBC without authentication:
$iv = random_bytes(16);
$encrypted = openssl_encrypt($data, 'AES-256-CBC', $key, 0, $iv);
// No MAC — ciphertext can be silently tampered

// AES-256-GCM — authenticated encryption:
$iv  = random_bytes(12); // 96-bit nonce for GCM
$tag = '';
$ciphertext = openssl_encrypt(
    $data, 'AES-256-GCM', $key, OPENSSL_RAW_DATA, $iv, $tag,
    $additionalData // Authenticated but not encrypted (e.g. sender ID)
);
$stored = base64_encode($iv . $tag . $ciphertext);

// Decryption verifies tag automatically — tampered data rejected

References

• ↗ https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

Tags

Related Terms