Block Cipher Modes

Block Cipher Modes of Operation | ECB, CBC, CFB, OFB & CTRDr Shanti Verma Lectures · ECB, CBC, CFB, OFB and CTR compared, 14 min

Block Cipher Modes of Operations (ECB, CBC, CFB, OFB, CTR)iq pop · the five block cipher modes with diagrams, 20 min

Why block ciphers need modes Search on YouTube

A block cipher encrypts a fixed-size block. DES encrypts 64-bit blocks. Real messages have an arbitrary length. A link needs a rule that turns the fixed-size cipher into a system for arbitrary data. That rule is a mode of operation.

NIST SP 800-38A defines 5 modes. They cover a wide variety of applications. Each mode can be used with any block cipher (DES, AES, and others).

Mode	Full name	Treats data as	Start value
ECB	Electronic Codebook	whole blocks, all independent	none
CBC	Cipher Block Chaining	whole blocks, chained	IV
CFB	Cipher FeedBack	a stream of bits	IV
OFB	Output FeedBack	a stream of bits	IV
CTR	Counter	a stream of bits	counter value

Learn all five in order: ECB, CBC, CFB, OFB, CTR. The exam asks for formulas, IV properties and error behaviour. It often asks for the whole table in one question.

Electronic Codebook (ECB)Search on YouTube

The message is broken into independent blocks. Each block is encrypted on its own. Each block is a value that is substituted, like a codebook entry. Hence the name.

$C_i = E_K[P_i] \qquad P_i = D_K[C_i]$

ECB encryption          P1 P2 P3 P4
                         |  |  |  |
                      E  K  K  K  K      (same key for every block)
                         |  |  |  |
                        C1 C2 C3 C4      (independent)

Use	Motive
Secure transmission of single values	one block, no linkage needed
Any value in a codebook lookup	one block in, one block out

Advantages and limitations in the slides:

ECB advantages	ECB limitations
Easy and simple	Message repetitions may show in ciphertext when aligned with block boundaries
Can operate in parallel	Graphics or messages that change little become a codebook analysis problem
No start value needed	Weakness comes from block independence
Main use: a few blocks of data	None

Two equal blocks encrypt to two equal blocks. A picture of a flat sky leaks a repeat pattern from ECB. The weakness is structural, not a key problem.

Cipher Block Chaining (CBC)Search on YouTube

The message is broken into blocks. The blocks are linked together in the encryption operation. Each previous cipher block is chained with the current plaintext block. Hence the name. An Initialization Vector (IV) starts the process.

$C_i = E_K[P_i \oplus C_{i-1}] \qquad C_0 = IV$

CBC encryption: each plaintext block XORs with the previous ciphertext block before encryption. The IV starts the chain.

CBC encryption
IV --⊕ P1--> E(K) --> C1
C1 --⊕ P2--> E(K) --> C2
C2 --⊕ P3--> E(K) --> C3   ...

CBC decryption
C1 --> D(K) --⊕ IV--> P1
C2 --> D(K) --⊕ C1--> P2
C3 --> D(K) --⊕ C2--> P3   ...

The IV prevents a repeated plaintext block from always yielding the same ciphertext block. Uses: bulk data encryption and authentication.

How CBC behaves Search on YouTube

A ciphertext block depends on all blocks before it. A change to one block affects all following ciphertext blocks. The slides call this effect the avalanche effect.

Property	Consequence
Block $C_i$ depends on $P_1,\ldots,P_i$	One plaintext change ripples through all later ciphertext
Decryption needs $C_{i-1}$	Cannot decrypt a middle block in isolation
Errors in one cipher block	Corrupt that block and the next plaintext block, then resynchronise

IV requirements Search on YouTube

The sender and the receiver must both know the IV. If the sender sends the IV in clear, an attacker can change bits of the first block. The attacker changes the corresponding bits of the IV. So the slides give four safe options:

Use a fixed value (as in EFTPOS).
Derive the IV in a way that is hard to manipulate.
Send the IV encrypted in ECB mode before the rest of the message.
Otherwise, check the message integrity.

A clear IV flips bits in $P_1$ . Bit $j$ of the IV maps to bit $j$ of the first plaintext block. Every later block is untouched. So the receiver must authenticate the IV, or the first block lies.

Cipher FeedBack (CFB)Search on YouTube

The message is treated as a stream of bits. The output of the block cipher is added to the message. The result is fed back for the next stage. Hence the name.

$C_i = P_i \oplus E_K[C_{i-1}] \qquad C_0 = IV$

CFB encryption
E(IV,K) --XOR--> P1 --> C1      (C1 fed back)
E(C1,K) --XOR--> P2 --> C2      (C2 fed back)

CFB decryption
E(IV,K) --XOR--> C1 --> P1      (C1 fed back)
E(C1,K) --XOR--> C2 --> P2      (C2 fed back)

The standard allows any number of bits to be fed back: 1, 8, 64 or 128. The notation is CFB-1, CFB-8, CFB-64, CFB-128. It is most efficient to use all bits in the block (64 or 128).

Variant	Bits fed back	Block cipher runs	Best suited for
CFB-1	1	once per bit	pure bit streams
CFB-8	8	once per byte	byte-oriented links
CFB-64	64	once per 64-bit segment	64-bit block ciphers at full width
CFB-128	128	once per 128-bit block	128-bit block ciphers at full width

Each variant still waits for a block encryption after every $s$ bits, where $s$ is the width in its name. Small $s$ means many stalls per block. Full width ( $s = 64$ or $128$ ) is the most efficient choice.

The s-bit Cipher FeedBack (CFB-s)Search on YouTube

The small variants feed the trailing $s$ bits of the last ciphertext block back into the shift register. The register then shifts by $s$ bits each round. The scheme stays usable when data arrives in bits or bytes. The following table keeps the slide wording.

CFB-s aspect	Slide detail
Variant names	CFB-1, CFB-8, CFB-64, CFB-128
Most efficient	feed all block bits (64 or 128) at once
Most common	stream mode in practice
Appropriate when	data arrives in bits or bytes
Limitation	must stall while doing a block encryption after every $s$ bits
Errors	propagate for several blocks after the error

Exam wording: "CFB is a stream mode that must still run block encryption every $s$ bits." Name both halves. Stream outside, block cipher inside, stall in between.

Output FeedBack (OFB)Search on YouTube

The message is again a stream of bits. The cipher output is added to the message. The output (and not the ciphertext) is then fed back. Hence the name.

$O_i = E_K[O_{i-1}] \qquad O_0 = IV \qquad C_i = P_i \oplus O_i$

OFB encryption
E(IV,K) --> O1 --XOR--> P1 --> C1      (O1 fed back, not C1)
E(O1,K)  --> O2 --XOR--> P2 --> C2

OFB decryption
E(IV,K) --> O1 --XOR--> C1 --> P1      (keystream reused)

Property	Meaning
Feedback is independent of the message	$O_i$ never depends on any $P_j$ or $C_j$
Can be computed in advance	Keystream grows without new plaintext
Needs a unique IV per use	Reuse lets an attacker recover the outputs
Bit errors do not propagate	A flipped bit corrupts its own bit position

If the IV repeats with the same key, the keystream repeats. Two messages then share a mask. The attacker computes the XOR of the two masks and recovers the outputs. This is the classic one-time pad (OTP) reuse failure.

Counter (CTR)Search on YouTube

A "new" mode, though proposed early on. Similar to OFB. The difference: CTR encrypts a counter value rather than any feedback value.

$O_i = E_K[\mathrm{CNT}_i] \qquad C_i = P_i \oplus O_i$

CTR encryption: each block encrypts a fresh counter value, then XORs the output with the plaintext block. Blocks are independent.

CTR encryption
CNT = 1,2,3,...  (or a base + block index)
E(CNT1,K) --XOR--> P1 --> C1
E(CNT2,K) --XOR--> P2 --> C2      (blocks are independent)

CTR decryption
E(CNTi,K) --XOR--> Ci --> Pi      (counter recomputed locally)

CTR rule	Detail
Fresh label per block	Need a different key and counter value for every plaintext block
Never reuse	Same warning as the OTP issue in OFB
Uses	High-speed network encryption

Advantages and limitations in the slides:

CTR advantages	CTR caveat
Efficiency: parallel encryptions in hardware or software	None
Can preprocess in advance of need	None
Good for bursty high-speed links	None
Random access to encrypted data blocks	None
Provable security, as good as the other modes	Must ensure never to reuse key or counter values, otherwise the scheme breaks (compare OFB)

The five modes side by side Search on YouTube

	ECB	CBC	CFB	OFB	CTR
Data type	block	block	stream	stream	stream
Encryption	$C_i = E_K[P_i]$	$C_i = E_K[P_i \oplus C_{i-1}]$	$C_i = P_i \oplus E_K[C_{i-1}]$	$C_i = P_i \oplus E_K[O_{i-1}]$	$C_i = P_i \oplus E_K[\mathrm{CNT}_i]$
Decryption	$P_i = D_K[C_i]$	$P_i = D_K[C_i] \oplus C_{i-1}$	$P_i = C_i \oplus E_K[C_{i-1}]$	$P_i = C_i \oplus O_i$	$P_i = C_i \oplus E_K[\mathrm{CNT}_i]$
Start value	none	IV ( $C_0$ )	IV ( $C_0$ )	IV ( $O_0$ )	counter sequence
Parallel encrypt	yes	no	no	no	yes
Precompute care	no	no	no	yes	yes
Error spread	one block	two blocks	several blocks	flipped bits	flipped bits
Main use	single values	bulk data, authentication	stream data, authentication	stream, precomputable	high-speed networks

Order hook: Every Code Breaker Crashes One Counter. ECB, CBC, CFB, OFB, CTR, in NIST SP 800-38A order. Reuse hook: One Never Pads Twice. OFB and CTR share the "never reuse the start value or counter" rule. Error hook: ECB one, CBC two, CFB several, OFB CTR clean. ECB corrupts one block. CBC corrupts two blocks. CFB spreads errors over several blocks. OFB and CTR damage only the flipped bits.

Mode misuse checklist Search on YouTube

The decks of the five modes share four failure rules. Read each before an exam answer:

Misuse	Mode	Effect named in the slides
Repeating plaintext with ECB	ECB	Repetitions show in the ciphertext
Clear IV with no integrity check	CBC	Attacker flips bits of the first block through the IV
Repeated IV	OFB	Attacker recovers the outputs, the OTP failure
Repeated key and counter pair	CTR	The scheme breaks, compare OFB

Exam trap: OFB and CTR look nearly identical. Tell them apart by what feeds the generator. OFB feeds back its own output $O_{i-1}$ . CTR feeds in a public counter $\mathrm{CNT}_i$ . OFB keystream needs no counter; CTR needs no feedback loop.

Chain rule summary. Every stream mode masks the plaintext with a generated value: $C_i = P_i \oplus X_i$ . ECB and CBC encrypt the plaintext directly: $C_i = E_K[\,P_i \oplus (\text{chain})\,]$ . CFB generates from the ciphertext $X_i = E_K[C_{i-1}]$ . OFB generates from its own output $X_i = E_K[O_{i-1}]$ . CTR generates from a counter $X_i = E_K[\mathrm{CNT}_i]$ .

Quick self-test Search on YouTube

Why do block cipher modes of operation exist?

Block ciphers encrypt fixed-size blocks (DES uses 64-bit blocks). Messages have arbitrary length. A mode links the per-block cipher into a system for arbitrary data. NIST SP 800-38A defines 5 modes.

Write the ECB encryption and decryption formulas and the main weakness.

Encryption: $C_i = E_K[P_i]$ . Decryption: $P_i = D_K[C_i]$ . Weakness: equal plaintext blocks give equal ciphertext blocks, so repeats in aligned data (graphics, slowly changing messages) leak a pattern. It is a codebook analysis problem.

What does a clear-text IV attack in CBC mode?

Only the first plaintext block. Changing bit $j$ of the IV changes bit $j$ of $P_1$ , since $P_1 = D_K[C_1] \oplus IV$ . Later blocks stay untouched. The slides list four defences: fixed IV (EFTPOS), a hard-to-manipulate derivation, encrypted IV in ECB mode, or message integrity checking.

How many bits can CFB feed back, and which size is most efficient?

Any number of bits: 1, 8, 64 or 128. The names are CFB-1, CFB-8, CFB-64, CFB-128. Feeding all block bits (64 or 128) is the most efficient. Small variants must stall for a block encryption after every $s$ bits.

Give the OFB formulas and state why the keystream is precomputable.

$O_i = E_K[O_{i-1}]$ with $O_0 = IV$ , and $C_i = P_i \oplus O_i$ . The value $O_i$ depends only on earlier $O$ values, the key and the IV. No plaintext or ciphertext enters the feedback loop. So the whole keystream can be generated before the data arrives.

Why is reusing an IV in OFB fatal?

The keystream repeats with the same key and IV. The attacker XORs the two ciphertexts, and the equal masks cancel. The attacker gets the XOR of the two plaintexts and can recover the outputs. This is the OTP reuse failure.

What does CTR encrypt instead of a feedback value?

A counter value: $O_i = E_K[\mathrm{CNT}_i]$ and $C_i = P_i \oplus O_i$ . Each block needs a different key and counter pair. The mode offers parallel work, preprocessing, random access and provable security. Never reuse the key or counter values.

Compare error propagation across ECB, CBC, CFB, OFB and CTR.

ECB: one corrupted ciphertext block damages one plaintext block. CBC: a corrupted block damages its own plaintext block and the next one. CFB: errors propagate for several blocks after the corruption. OFB: bit errors do not propagate, only the flipped bits are wrong. CTR behaves like OFB.

Which modes allow parallel encryption and preprocessing?

Parallel encryption: ECB and CTR only. CBC, CFB and OFB encryption are sequential, because each step needs the previous value. Preprocessing ahead of data arrival: OFB and CTR, because their generated values depend on no message bits. CFB and CBC wait for earlier cipher blocks.

Match each mode to a typical use named in the slides.

ECB: secure transmission of single values. CBC: bulk data encryption and authentication. CFB: stream data encryption and authentication. OFB: stream encryption with precomputed keystream. CTR: high-speed network encryption on bursty links.

Modes cover arbitrary data over a fixed-block cipher. NIST SP 800-38A defines the five modes in order: ECB, CBC, CFB, OFB, CTR.
ECB is $C_i = E_K[P_i]$ : parallel, simple, and leaks repeats. CBC chains $C_i = E_K[P_i \oplus C_{i-1}]$ : avalanche effect, IV rules, bulk data use.
CFB is $C_i = P_i \oplus E_K[C_{i-1}]$ : stream in, block cipher inside, stall every $s$ bits, errors hit several blocks.
OFB is $C_i = P_i \oplus E_K[O_{i-1}]$ with $O_0 = IV$ : keystream independent of the message, so it is precomputable and error-free per bit, but a reused IV is fatal.
CTR is $C_i = P_i \oplus E_K[\mathrm{CNT}_i]$ : parallel, preprocessing friendly, random access, provable security; a reused key and counter pair breaks the scheme.

Why block ciphers need modesSearch on YouTubeBookmarkSaved

Electronic Codebook (ECB)Search on YouTubeBookmarkSaved

Cipher Block Chaining (CBC)Search on YouTubeBookmarkSaved

How CBC behavesSearch on YouTubeBookmarkSaved

IV requirementsSearch on YouTubeBookmarkSaved

Cipher FeedBack (CFB)Search on YouTubeBookmarkSaved

The s-bit Cipher FeedBack (CFB-s)Search on YouTubeBookmarkSaved

Output FeedBack (OFB)Search on YouTubeBookmarkSaved

Counter (CTR)Search on YouTubeBookmarkSaved

The five modes side by sideSearch on YouTubeBookmarkSaved

Mode misuse checklistSearch on YouTubeBookmarkSaved

Quick self-testSearch on YouTubeBookmarkSaved

On this page