Symmetric Cryptography and Block Cipher Modes
Block ciphers process fixed-size blocks under a key; a mode of operation turns that primitive into a scheme for arbitrary-length data. The exam tests which mode provides what, how IVs and nonces must be handled, and which historical ciphers are dead.
The ciphers
- DES: 64-bit block, 56-bit key, Feistel network; brute-forced in the late 1990s and must not be used.
- 3DES (EDE): 112 or 168 effective bits but still a 64-bit block, so birthday collisions appear near 2^32 blocks (Sweet32).
- AES: 128-bit block, 128/192/256-bit keys, substitution-permutation network; still the default.
- Feistel splits the block and leaves half unmodified per round; an SPN transforms the whole block each round.
The modes
- ECB encrypts identical plaintext blocks identically. It is deterministic and leaks structure; never use it for real data.
- CBC XORs an IV into the first block; the IV must be unpredictable and unique, and without a MAC, CBC invites bit-flipping and padding-oracle attacks.
- CTR turns the cipher into a stream; reusing a nonce is catastrophic, since C1 XOR C2 equals P1 XOR P2.
- GCM is AEAD, giving confidentiality plus integrity, but nonce reuse destroys the authentication key.
- CFB and OFB also behave as streams. The safe general patterns are encrypt-then-MAC or an AEAD mode.
Worked example
A 1000-byte plaintext is encrypted with AES-CBC and PKCS#7 padding. 1000 / 16 = 62 full blocks with 8 bytes left over; the final block is padded with 8 bytes of value 0x08, giving 63 blocks and a 1008-byte ciphertext. Padding is always added, even when the plaintext is an exact multiple of 16, in which case a whole block of 0x10 is appended.
Traps
An IV is not a secret key, but it must be unique; ECB has no IV; cipher and mode are separate choices; a 64-bit block size limits safe data volume regardless of key length.