Block Cipher Modes of Operation

AES, the successor to DES, is based on the substitution-permutation network (SP-network) design of Rijndael, rather than the Feistel structure.

SP-Network

Proposed by Claude Shannon in 1945: a series of linked permutation and substitution operations.

• Diffusion
  Permutations disperse the statistical characteristics of each input bit among all output bits.
• Confusion
  Substitutions create a complex relationship between the input and key with the output, providing the cipher’s non-linearity.

Modes of Operation

A mode of operation combines a block cipher into a usable block encryption scheme. DES was standardized with 4 modes:

• ECB, useful for encrypting short secrets such as session keys.
• CBC, useful for bulk data encryption.
• OFB, useful for real-time streamed content.
• CFB, useful for streamed content.

CTR mode, enabling parallel block encryption, was developed later.

ECB

Electronic Code Book: each plaintext block is encrypted independently.

CBC

Cipher Block Chaining: chains each ciphertext block into the encryption of the next, giving every block context.

• A single ciphertext bit error corrupts its own plaintext block fully, plus a single bit in the next block, giving 1-block error propagation.
• A fixed public IV (e.g. all-0) need not be transmitted. A random nonce IV must be sent alongside the ciphertext.

OFB

Output Feedback: runs the block cipher as a keystream generator, turning it into a stream cipher.

with $Y_0 \leftarrow IV$. Both encryption and decryption use $e_k$, never $d_k$.

CFB

Cipher Feedback: also produces a keystream, but feeds the ciphertext itself back into the cipher input.

with $Y_0 \leftarrow IV$ and $Z_i^*$ the leading $b$ bits of $Z_i$. Decryption mirrors this using $c_i$ in place of $m_i$.

CTR

Counter mode: like ECB, but XORs plaintext with the encryption of a counter rather than encrypting the plaintext directly.

where $\langle i \rangle_b$ is the $b$-bit binary representation of $i$.

• Blocks can be encrypted in parallel, like ECB, since each block is independent.
• The counter provides context, preventing the cut-and-paste and rearrangement attacks possible against ECB.