AES 動作モードの理解

问题

AES モードを選ぶ必要がありますが、ECB、CBC、CTR、GCM がセキュリティと性能の点でどう違うのかがわかりません。

前提条件

• AES ブロック暗号の理解
• IV とパディングに関する知識

ステップ

1. 1. Review the mode characteristics

   ECB encrypts each block independently and leaks patterns. CBC chains blocks with an IV and requires padding. CTR turns AES into a stream cipher and needs no padding. GCM adds authentication on top of CTR. Each mode has different security properties and performance trade-offs.

   入力

   modes: ECB, CBC, CTR, GCM

   输出

   GCM recommended for most uses

2. 2. Evaluate authentication needs

   If you need to detect tampering, use an authenticated mode like GCM or ChaCha20-Poly1305. CBC and CTR provide confidentiality only; an attacker can modify the ciphertext undetected. Adding an HMAC over the ciphertext is an alternative for non-GCM modes.

   入力

   need integrity?

   输出

   use GCM or Encrypt-then-MAC

3. 3. Choose based on constraints

   For most modern applications, GCM is the default choice: it provides authenticated encryption and is hardware-accelerated. Use CTR for streaming contexts where authentication is handled separately. Never use ECB for more than a single block.

   入力

   general purpose

   输出

   AES-256-GCM

期待される結果

ユースケースに必要なセキュリティ特性を提供する AES モードの、十分な根拠のある選択。

よくあるエラー

Using ECB for multi-block data

ECB leaks patterns. The famous ECB penguin image demonstrates how identical plaintext blocks produce identical ciphertext blocks. Use CBC or GCM instead.

Using CBC without authenticating the ciphertext

CBC is malleable. Apply an HMAC over the IV and ciphertext (encrypt-then-MAC) or switch to GCM.

トラブルシューティング指引

• If performance is critical, GCM is hardware-accelerated on modern CPUs via AES-NI.
• If you need a stream cipher without padding, CTR mode is the right choice.

セキュリティ上の制限

• Always prefer authenticated encryption (GCM). Non-authenticated modes allow ciphertext manipulation.