Summary of AES Encryption Modes

Block Ciphers vs. Stream Ciphers

Broadly speaking, the cryptographic algorithms we use can be categorized into two types: block ciphers and stream ciphers.

Block Ciphers: An encryption algorithm that processes a fixed-length block of plaintext at a time, producing a fixed-length block of ciphertext.

  • This fixed-length plaintext segment is called a block, and its length is the block size.
  • The block size, key length, and ciphertext length of a block cipher algorithm are not necessarily the same; for example, AES128 has a block size of 128 bits, can use 128/192/256-bit keys, and encrypts 16 bytes of plaintext at a time to generate 16 bytes of ciphertext.

Stream Ciphers: Cryptographic algorithms that process data streams continuously.

  • Stream ciphers typically encrypt and decrypt data in units of 1 bit, 8 bits, or 32 bits.
  • A typical stream cipher is RC4, which was once widely used in Wi-Fi’s WEP, WPA1 encryption authentication algorithms, and even TLS implementations. However, multiple severe vulnerabilities have been found in its applications, leading to RFC7465 prohibiting its use in TLS.

Most symmetric-key algorithms widely used in various fields today (such as DES, 3DES, AES, etc.) are block ciphers, and all asymmetric encryption algorithms internally use block ciphers for encryption and decryption.

Definition and Classification of Block Cipher Modes of Operation

Definition of Encryption Modes:

  • A block cipher algorithm can only encrypt a fixed-length block of plaintext at a time. Therefore, if the plaintext to be encrypted exceeds the block length, it needs to be segmented according to the block length. The method for encrypting multiple segments of a long plaintext is called the encryption mode (or mode of operation) of that cryptographic algorithm.
  • The most direct approach is to encrypt each segment independently; this is the ECB mode discussed below, which carries significant cryptographic risks and vulnerabilities and is not recommended for practical use.

Main Encryption Modes for Block Ciphers:

  • ECB mode;
  • CBC mode;
  • CFB mode;
  • OFB mode;
  • CTR mode;

ECB Mode

ECB: Electronic CodeBook mode;

Basic Idea: Each fixed-length plaintext block is encrypted and decrypted independently. Encryption/decryption operations between blocks are unrelated, meaning identical plaintext blocks will be encrypted to identical ciphertext blocks. This resembles a massive “plaintext block -> ciphertext block” lookup table, hence the name Electronic CodeBook mode.

Untitled.png

CBC Mode

CBC: Cipher Block Chaining mode;

During encryption and decryption, ciphertext blocks are linked together like a chain. In CBC mode, when performing encryption, the plaintext block to be encrypted is XORed with the previous ciphertext block before being encrypted. Decryption works in the opposite way: the ciphertext block to be decrypted is first decrypted, and then the resulting intermediate plaintext is XORed with the previous ciphertext block to obtain the final decrypted plaintext.

Untitled.png

Initialization Vector (IV)

  • From the CBC mode encryption/decryption flow above, it can be seen that the execution of encryption/decryption for each block depends on the ciphertext generated by the encryption of the previous block. However, for the first block’s encryption/decryption, since there is no preceding ciphertext block, an Initialization Vector (IV) is required to start the process for the first block. This is commonly abbreviated as IV.
  • Generally, a different random bit sequence is generated as the IV for each encryption/decryption operation. Therefore, before encryption/decryption, a mechanism is needed to synchronize the IVs at both ends to ensure correct processing of the first block.

When using CBC mode for encryption/decryption, if a ciphertext block’s data is corrupted or lost at the decryption end, it will affect the correct decryption of the current block and the next block. Subsequent blocks’ decryption will not be affected.

Untitled.png

  • Similarly, if the decryption end does not have the correct IV, the first block will fail to decrypt, but subsequent blocks can still be decrypted correctly.
  • SSL/TLS, which ensures secure internet access, uses CBC mode as its encryption mode;

CFB Mode

CFB: Cipher Feedback mode.

The specific execution flow is similar to CBC mode, except that in CFB mode, the ciphertext of the previous block is encrypted and then XORed with the plaintext of the current block.

  • Encryption end: The ciphertext block generated from the previous block is subjected to symmetric encryption. The result of this symmetric encryption operation is then XORed with the current block’s plaintext to obtain the current block’s ciphertext.
  • Decryption end: The ciphertext content from the previous block is subjected to symmetric encryption. The result of this symmetric encryption operation is then XORed with the current block’s ciphertext content to obtain the current block’s plaintext.

Untitled.png

  • From the flowchart above, a crucial point about CFB mode is that for the encryption of a plaintext block, the symmetric encryption algorithm is not actually applied directly to the plaintext content of that block (instead, it operates on the ciphertext block from the previous step). However, an XOR operation is performed, meaning this XOR operation effectively acts as the encryption for the plaintext block.

The requirements for an Initialization Vector in CFB mode are consistent with CBC mode: a consistent random bit sequence must be generated at both ends as the IV before each encryption/decryption operation.

Since CFB mode does not apply symmetric encryption directly to the plaintext block for protection, and decryption simply recovers the plaintext block content via XOR, this mode is susceptible to replay attacks.

  • An attacker can intercept multiple consecutive segments of ciphertext data and then replace/inject these segments into new communication/data content. At the decryption end, except for the first replaced ciphertext block which will fail to decrypt, subsequent ciphertext blocks will be correctly decrypted, thus being mixed into the original communication/data.

Untitled.png

  • For this type of attack, adding a Message Integrity Code (MIC) to the entire message is necessary to resolve the issue.

OFB Mode

OFB: Output Feedback mode.

OFB is similar to CFB, except that in CFB mode, the input to the symmetric encryption algorithm is the ciphertext of the previous block, while in OFB mode, the input to the symmetric encryption algorithm is the output of its previous operation.

  • Encryption end: Starting with the Initialization Vector (IV), the IV is used as input to the symmetric encryption algorithm. The result of this symmetric encryption operation (which also serves as the input for the symmetric encryption algorithm in the next block’s encryption operation) is then XORed with the plaintext of the block to be encrypted to obtain the ciphertext block.
  • Decryption end: Starting with the Initialization Vector (IV), the IV is used as input to the symmetric encryption algorithm. The result of this symmetric encryption operation (which also serves as the input for the symmetric encryption algorithm in the next block’s decryption operation) is then XORed with the ciphertext of the block to be decrypted to obtain the plaintext block.

Untitled.png

Untitled.png

The requirements for an Initialization Vector in OFB mode are consistent with CBC and CFB modes: a different random sequence is generally required to be generated as the IV for each encryption/decryption operation.

OFB mode boasts very fast execution speeds.

  • From the OFB mode encryption/decryption flowchart above, it can be seen that during encryption and decryption, XOR operations are very fast. The keystream required for XOR operations (which is the result of multiple consecutive executions of the symmetric encryption algorithm) is independent of the plaintext and ciphertext block content. It can be pre-generated based on the cryptographic algorithm, key, and initialization vector. Therefore, during the actual encryption/decryption process, only an XOR operation between the pre-generated keystream and the plaintext/ciphertext block is needed, resulting in very fast execution.

OFB mode has very strict requirements for data integrity and order.

  • The keystream in OFB mode (i.e., the results of consecutive executions of the symmetric encryption algorithm) has a very strong sequential dependency. Plaintext and ciphertext blocks used in encryption and decryption operations must correspond one-to-one in order. If the ciphertext data being decrypted at the receiver end has an incorrect sequence or partial data loss, it will cause all subsequent data decryption to fail. However, if only data within a specific ciphertext block is erroneous, the decryption error for that block will only affect the current block and will not impact the decryption of the next block.
  • This contrasts sharply with CBC and CFB modes. In the latter two, if data is out of order or partially lost, it will only affect the current and the next block, not leading to decryption errors for all subsequent blocks. However, if data within a specific ciphertext block is erroneous, decryption in CBC and CFB modes will cause errors not only in the current block but also in the next block.

CTR Mode

CTR: Counter mode.

Similar to OFB mode, the difference is:

  • In OFB mode, the input to the symmetric encryption algorithm comes from the output of its previous execution;
  • While in CTR mode, the input to the symmetric encryption algorithm comes from the value of an accumulating counter.

Untitled.png

Untitled.png

Counter Generation and Accumulation

  • Before starting, CTR mode requires an initial random Nonce to be agreed upon by both the encryption and decryption ends. This Nonce consists of two parts: for example, the first 8 bytes serve as a fixed, randomized Nonce and remain constant throughout subsequent operations, while the latter 8 bytes increment by 1 with each operation. This method ensures that the counter value is unique each time, and thus the keystream obtained by feeding this counter value into the symmetric encryption algorithm for encryption will also be unique.
  • Nonce example: 66 1F 98 CD 37 A3 8B 4B 00 00 00 00 00 00 00 01; the first 8 bytes remain unchanged, and the latter 8 bytes accumulate incrementally.

Regarding computational speed, since the calculation process of CTR mode is fundamentally consistent with OFB mode, CTR mode also boasts very fast operation speeds. Furthermore, the nonce and block sequence number used in CTR mode can be directly computed, enabling parallel processing. In systems that support parallel computing, CTR mode’s operational speed surpasses that of OFB, which cannot support parallel operations.

In terms of fault tolerance, CTR mode is largely consistent with OFB mode. If some data within a block is erroneous, it will only cause decoding errors for that specific block and will not propagate to subsequent blocks.

References:

  • “Illustrated Cryptography, 3rd Edition,” Chapter 4;