A block cipher such as AES can do only one thing: take a 16-byte block and transform it, with a key, into another 16-byte block. But a file, a message or a connection is made of thousands or millions of blocks. The way these blocks are linked together is called the mode of operation, and choosing it matters as much as choosing the algorithm. Two systems that both use "AES-256" can have very different levels of security.
ECB: the simplest wrong way
In ECB mode (Electronic Codebook), each block is encrypted independently with the same key. It is the most intuitive solution, and that is exactly why it should be avoided.
The problem is that identical plaintext blocks produce identical ciphertext blocks. If a file contains repetitions, they remain visible even after encryption. The most famous example is a bitmap image encrypted in ECB: the colours become random, but the outline of the picture remains perfectly recognisable.
ECB also allows blocks to be reordered, duplicated or replaced without the recipient noticing. There is no practical situation in which it is the right choice for encrypting real data.
CBC: chaining the blocks
CBC mode (Cipher Block Chaining) solves the repetition problem by linking each block to the previous one:
- before encrypting a block, it is combined with the previous ciphertext block using XOR;
- for the first block, which has no predecessor, an initialisation vector (IV) is used, a random 16-byte value.
This way two identical blocks in different positions produce different results, and the same message encrypted twice with different IVs gives two different ciphertexts.
CBC was the most widely used mode for years, but it has some important limitations:
- the IV must be unpredictable: a repeated or guessable IV enabled practical attacks against past versions of TLS;
- it requires padding to bring the data to a multiple of 16 bytes, and the handling of padding errors gave rise to so-called padding oracle attacks, in which a server that reveals whether the padding is correct allows data to be decrypted one byte at a time;
- it does not protect integrity: an attacker can modify the ciphertext and obtain controlled changes in the plaintext;
- encryption cannot be parallelised, because each block depends on the one before.
CTR: turning a block cipher into a stream cipher
CTR mode (Counter) works differently: instead of encrypting the data, it encrypts a sequence of values made of a nonce and a counter that increases by one for each block. The result is a stream of pseudorandom bytes that is combined with the data using XOR.
The advantages are considerable:
- no padding: exactly the length of the data is encrypted;
- full parallelisation, for both encryption and decryption;
- the ability to decrypt any point in the file without starting from the beginning.
The main risk is nonce reuse: if the same key and nonce combination is used for two messages, combining the two ciphertexts cancels out the pseudorandom streams and yields a direct comparison of the two plaintexts. Moreover, like CBC, CTR on its own does not protect integrity.
GCM: encryption and authentication together
GCM mode (Galois/Counter Mode) combines CTR encryption with an authentication mechanism. In addition to the ciphertext it produces an authentication tag, typically 16 bytes, computed over the whole message.
When decrypting, the recipient recomputes the tag: if it does not match, the message has been altered or the key is wrong, and the data is discarded without being returned. This scheme is called authenticated encryption with associated data (AEAD): it can also authenticate information that must remain in plain text, such as packet headers, binding it to the encrypted content.
GCM is now the default mode in TLS and in a great many other protocols. It does, however, have a strict requirement: the nonce must never repeat with the same key. A repetition compromises the confidentiality of the messages involved and makes it possible to forge authentication tags. Variants such as AES-GCM-SIV exist, designed to limit the damage if nonces are repeated.
The most widespread alternative to AES-GCM is ChaCha20-Poly1305, also an authenticated encryption scheme, particularly fast on devices without hardware acceleration for AES.
A summary comparison
| Mode | Hides repetitions | Protects integrity | Initial value | Recommended use |
|---|---|---|---|---|
| ECB | No | No | None | Never, for real data |
| CBC | Yes | No | Random, unpredictable IV | Existing systems only, with separate authentication |
| CTR | Yes | No | Unique nonce | As a basis for authenticated modes |
| GCM | Yes | Yes | Unique nonce | Default choice |
Disks use a specific mode, XTS, designed to encrypt fixed-size sectors without extra space for IVs or tags.
In short
- The mode of operation decides how a block cipher handles data longer than one block.
- ECB reveals repetitions and should never be used for real data.
- CBC and CTR hide repetitions but do not protect integrity.
- GCM and ChaCha20-Poly1305 provide authenticated encryption and are today's default choices.
- The nonce or IV must never repeat with the same key.
