AES Block Cipher Modes Reference
Operation modes for AES including ECB, CBC, CTR, GCM, and their security properties.
Common Modes
A block cipher like AES encrypts fixed 16-byte blocks, so a mode of operation extends it to arbitrary-length inputs. The mode determines how blocks are chained and whether confidentiality, integrity, or both are provided. Choosing the wrong mode can leak information even when the underlying cipher is secure. Modern applications should prefer authenticated modes unless there is a specific reason not to.
- ECB
- Each block encrypted independently, no IV, reveals patterns
- CBC
- Each block XORed with previous ciphertext, needs IV
- CTR
- Turns block cipher into stream cipher via counter nonce
- GCM
- CTR encryption plus GMAC authentication tag
- CCM
- CBC-MAC plus CTR, used in wireless
insecure for multi-blockno integrityparallelizableauthenticated, AEADauthenticated, AEADInitialization Vectors
CBC and CTR modes require an initialization vector or nonce that must be unpredictable and never reused with the same key. In GCM, reusing a nonce is catastrophic because it reveals the authentication key and allows forgery. A 96-bit nonce is recommended for GCM to enable efficient counter arithmetic. Generating nonces with a cryptographically secure random source is essential for safety.
Padding for Block-Aligned Modes
CBC requires the plaintext to be a multiple of the block size, so padding is added before encryption. PKCS#7 padding appends N bytes each with value N, and is stripped after decryption by reading the last byte. CTR and GCM are stream-oriented and need no padding, which simplifies implementation. Mismatched padding strategies between encryptor and decryptor cause silent corruption or padding oracle attacks.