Block Cipher Modes of Operation

1. Why Modes Exist

Block ciphers (DES/AES) encrypt ONE block; messages are longer. A mode defines how blocks chain: $C_i = E_K(\text{something}_i)$ . ECB (independent blocks) leaks patterns — every later mode adds an IV/chaining so equal plaintexts differ. (Module 4 Topic 5 revisits modes with AES/streaming context; formulae identical.)

2. The Five Classical Modes (Formula Table)

Mode	Encrypt	Decrypt	IV?	Parallel?	Error spread
ECB	$C_i = E_K(P_i)$	$P_i = D_K(C_i)$	No	Both ✓	1 block only
CBC	$C_i = E_K(P_i \oplus C_{i-1})$ , $C_0 = IV$	$P_i = D_K(C_i) \oplus C_{i-1}$	Random, secret needn't be	Encrypt ✗, decrypt ✓	2 blocks (bit error in $C_i$ garbles $P_i$ + flips bit in $P_{i+1}$ )
CFB (r-bit)	$I_i = E_K(\text{shift reg})$ ; $C_i = P_i \oplus \text{msb}_r(I_i)$ ; feed $C_i$ back	Same with $C_i$ fed	Random	Encrypt ✗, decrypt ✓	~2 segments; self-synchronizing
OFB	$O_i = E_K(O_{i-1})$ , $O_0 = IV$ ; $C_i = P_i \oplus O_i$	Identical (XOR)	Random, NEVER reuse	✗ (chained)	1 bit only — but bit-flip attack!
CTR	$C_i = P_i \oplus E_K(\text{nonce} \Vert i)$	Identical (XOR)	Nonce+counter, unique	Both ✓	1 bit only — needs integrity (GCM)

3. Worked ECB Leak + CBC Trace

ECB penguin: identical $P$ blocks (image background, salary field " $1000" repeated) → identical$ C$ blocks — pattern visible without decrypting. Textbook demo: ECB-encrypted Tux bitmap still shows the penguin.

CBC mini-trace (toy $E_K(X) = X \oplus K$ for illustration, $K = 1010$ , $IV = 0000$ ): $P_1 = 1100 \to C_1 = E(1100 \oplus 0000) = 0110$ ; $P_2 = 1100$ (same!) $\to C_2 = E(1100 \oplus 0110) = E(1010) = 0000
e C_1 $✓ — chaining hides equality. Decrypt:$ P_2 = D(0000) \oplus 0110 = 1010 \oplus 0110 = 1100$ ✓.

4. Selection Rules and Pitfalls

Never ECB for >1 block (BEU's favourite "why is ECB bad" with penguin/salary example).
CBC: needs random unpredictable IV (predictable IV → chosen-plaintext leak, TLS 1.0 BEAST); padding oracle risk — always add MAC (Encrypt-then-MAC) or use GCM.
CTR/GCM: random-access, parallel, no padding — modern default (TLS 1.2+, IPsec); nonce reuse in CTR/GCM = catastrophic (keystream repeat → $C_1 \oplus C_2 = P_1 \oplus P_2$ + GCM auth-key recovery).
CFB/OFB: convert block cipher to stream — CFB self-syncs after errors (radio links), OFB needs intact keystream (bit-flip = targeted plaintext flip without detection).
Rule of thumb: confidentiality mode + separate integrity, or AEAD (GCM/CCM/ChaCha-Poly) doing both.

Exam Points

Five formulae + IV/parallel/error columns — 5-mark table core.
ECB penguin + CBC toy trace showing equal $P \to$ different $C$ — standard numerical.
Nonce/IV-reuse disasters (CTR two-time pad, CBC predictable-IV) — 2–3 mark justifications.
"Use GCM/AEAD in practice" closing line.

Block Cipher Modes of Operation