Cryptography Under the Hood: How Modes of Operation Strengthen Encryption

In the last article, we understood symmetric and asymmetric key encryption, and in this article, we will learn about different modes of cryptography. As we know there are different algorithms for symmetric & Asymmetric encryption.

We talked about ciphers and block ciphers in the prior post. A block cipher on its own would only ever encrypt a single block of data. That’s why there’s also something called a mode of operation that can be used to deal with multiple blocks of input data.

In fact, a mode of operation describes exactly how a cipher’s operation gets applied to every single block of data.

The reason that matters is because an important part of encryption is creating randomness. Whenever you have repeating inputs of plaintext, you want the output to look different because otherwise, it gives attackers a weakness they can use to crack the encryption.

If we were to just blindly apply a block cipher to every single block of data, then we would end up with lots of ciphertexts that look the same.

Modes of operation examples

Some examples of modes of operation include:

• Electronic Code Book (ECB)
• Cipher Block Chaining (CBC)
• Cipher Feedback Mode (CFB)
• Counter Mode (CTR)

Block ciphers are typically used in conjunction with modes of operation to encrypt data larger than a single block. Common modes include:

1. ECB (Electronic Codebook): Simplest mode, where each block is encrypted independently. However, it is insecure for encrypting multiple blocks of data due to patterns that can emerge.
2. CBC (Cipher Block Chaining): Each block of plaintext is XORed with the previous ciphertext block before being encrypted. This introduces dependencies between blocks, enhancing security.
3. CFB (Cipher Feedback) and OFB (Output Feedback): Convert block ciphers into stream ciphers by generating keystreams that are XORed with plaintext.
4. CTR (Counter): Converts a block cipher into a stream cipher by encrypting successive values of a counter, which are then XORed with plaintext blocks.
5. Galois Counter Mode (GCM)

Let’s understand these modes in detail one by one

Electronic Code Book(ECB) mode:-

• In this method , every block is individual . There is no dependency on the next block with the previous block . So we can do parallel computing and encrypt all blocks parallel and encryption is done super fast .
• Challenge :- We don’t lose any information in this mode and it gives the same values to the same type of blocks. So we get a pattern after encryption . So this mode is easy to break .

Example:-

Here we can see the “hello” block has value “abc” and wherever we find the “hello” block then it converts into “abc” . So we found a pattern . and it is easy to break .

Similarly in image we don’t lose any information by EBC mode and we can see a similar kind of image after encryption .

There is no dependency between the previous block and the next block. So we can do encryption & decryption parallelly.

Cipher Block Chaining(CBC) Mode

• Every algorithm has these modes .
• In CBC mode , we have blocks and before converting into cipher text , we add random data with plain text and do XOR of both plain text and random data and then we get cipher text . This random data is called Initialization Vector (IV)
• Cipher Block Chaining (CBC) mode is a commonly used mode of operation for block ciphers that enhances the security of the basic encryption process by introducing dependencies between the plaintext blocks. This mode ensures that identical plaintext blocks produce different ciphertext blocks, even when the same key is used.
• In CBC mode, each plaintext block is XORed with the previous ciphertext block before being encrypted. This chaining mechanism introduces a dependency between blocks, making the encryption process more secure.

Encryption in CBC mode

• Cipher block chaining is a process used to encrypt and decrypt large plaintext inputs by creating a cryptographic chain wherein each ciphertext block is dependent on the last.
• The first step to initiating a cipher block chain is to XOR the first of many plaintext blocks with an IV — a unique, fixed-length conversion function — to create a random, or pseudorandom, output. This XOR output is then encrypted using a cipher key to produce a ciphertext block, an encrypted text format that can be decrypted with the correct key.
• For example, after the first plaintext block has been transformed into a ciphertext block, the subsequent plaintext block must be encrypted using a similar process. The only difference, however, is that the ciphertext block replaces the IV as one of the XOR inputs. This means that the encryption of the plaintext block after the first one is dependent on the encryption of the first plaintext block. With each plaintext block encryption, the adjacent ciphertext block must be used — like a chain. Therefore, the second ciphertext block is produced by XORing the first ciphertext block with the second plaintext block and using the same encryption key. This process would repeat itself until there is no more plaintext left to encrypt.

Decryption in CBC

The CBC decryption process works in a similar but distinct way. Contrary to similar decryption methods, the process does not start with the final ciphertext block. In fact, it can all happen simultaneously because all inputs are present.

• To invert the cipher block chaining procedure, one must essentially reverse the encryption process. To do that, one must first feed the first ciphertext block through the decryption process. This involves using the same encryption key as before but on the ciphertext block. The product of this interaction is then XORed with the original IV to extract the original plaintext block. While similar, decrypting the second ciphertext block is different from decrypting the first one because an IV cannot be used.
• After combining the second ciphertext block with the cipher key, the output is XORed with the first ciphertext block to produce the second plaintext block. In this case, the previous ciphertext block replaces the IV during the decryption process. Remember, this is how the second ciphertext block was originally created; the second plaintext block and the first ciphertext block were XORed together. The process is complete once all ciphertexts have been successfully decrypted into plaintext.
• Identical ciphertext blocks can only be produced if the same plaintext block is encrypted using the same key, IV and ciphertext block order. Ideally, the IV should be different for any two messages encrypted with the same key. Patterns like this can make it that much easier for malicious hackers or cybercriminals to decrypt a series of responses because the decryption is more predictable.

Challenge:-

1. If one or more of the ciphertext blocks becomes lost, damaged or corrupted, a user won’t be able to perform a complete decryption.
2. As we know that each block is dependent on each other . So we aren’t able to perform parallel computing.
3. Also it is slow comparatively EBC mode.
4. We cannot perform parallel encryption but we can perform parallel decryption.

Cipher Feedback Mode (CFB)

In this , first we have IV( Initialisation Vector)

Step-1 We encrypt IV with the help of the master key . This encryption takes more time . So we first encrypt IV with a master key .

Step-2 Then we have Plain text . So we use the first block and perform XOR with our calculated encrypted IV . XOR does not take much time .

Step-3 Then we pick the next block and do XOR with encrypted IV . As time consuming encryption we calculate once and XOR does not take much time .

It is very fast because most of the time consuming part is already calculated. It does not support parallelism . It is used for streams . It works on units . So we don’t need to add padding in this mode. To learn more

Difference between CBC & CFB

1. Error Propagation:

CBC: A bit error in a ciphertext block affects the decryption of the current and next block.

CFB: A bit error in a ciphertext segment affects the decryption of the current and the next few segments, but not as widely as CBC.

2. Feedback Mechanism:

CBC: Each plaintext block is XORed with the previous ciphertext block before encryption.

CFB: Each plaintext segment is XORed with the output of the block cipher encryption of the previous ciphertext segment (or IV for the first segment).

Counter Mode (CTR)

Next, we have the Counter Mode, also known as CTR or CTM. This is a commonly used mode of operation that’s also recommended by NIST.

One of the key features of CTR is that you can parallelize encryption and decryption…it doesn’t require chaining. So, this behaves similarly to stream ciphers which provide faster performance.

It’s able to do that by using a counter function to generate a nonce value for each block’s encryption. That nonce number (aka the counter) gets encrypted and then XORed with the plaintext to generate ciphertext. Because every single counter value should be different and should never get re-used, the resulting ciphertext should also always end up being different.

All of that makes CTR/CTM a mode of operation that is considered to be secure.

Counter (CTR) mode is a mode of operation for block ciphers that transforms a block cipher into a stream cipher. It is widely used due to its efficiency and parallelizability

Encryption Process

The encryption process in CTR mode involves the following steps:

1. Initialization: Choose a unique nonce for the encryption session.

Initialise the counter (usually starting at zero or a predefined value).

2. Generate Counter Values:For each block of plaintext, generate a counter value by concatenating the nonce with the counter.

3. Encrypt Counter Values:Encrypt each counter value using the block cipher and the secret key to produce an encrypted counter block.

4. XOR with Plaintext:XOR the encrypted counter block with the corresponding block of plaintext to produce the ciphertext block.

5. Increment Counter:Increment the counter for the next block.

Decryption

• Step 1: Use the Same Nonce and Counter
• The receiver must know the same nonce and starting counter value that was used for encryption.
• Step 2: Generate the Same Key Stream
• For each ciphertext block, the receiver generates the keystream by encrypting the concatenated nonce and counter values using the same block cipher and key.
• Step 3: XOR with Ciphertext
• XOR the generated key stream with the corresponding block of ciphertext to recover the original plaintext.
• Step 4: Increment the Counter
• After processing each block, increment the counter and repeat the steps for the remaining blocks.

Key Points of Counter

• Parallelizable: Both encryption and decryption can be done in parallel because each block is encrypted/decrypted independently.
• Stream Cipher-Like Behavior: CTR mode transforms a block cipher into a stream cipher by generating a key stream.
• Nonce Importance: The nonce must be unique for each encryption session. Reusing a nonce with the same key can lead to vulnerabilities and compromise the security of the encrypted data.

Galois Counter Mode (GCM)

Galois/Counter Mode (GCM) is a powerful cryptographic mode that combines the efficiency of Counter Mode (CTR) with Galois authentication, providing both encryption and data authentication. This means not only is the data encrypted, but the source of the data is also authenticated, ensuring both confidentiality and integrity. GCM offers the dual advantage of securing the data while confirming it hasn’t been altered or tampered with.

One of GCM’s key strengths is its speed, making it one of the fastest encryption modes available. It’s widely recognized for its performance and is endorsed by NIST (National Institute of Standards and Technology). Additionally, GCM is used in the IEEE 802.1AE standard, which governs security for MAC (Media Access Control) in network communications.

In the sections ahead, we’ll explore how GCM ensures these security properties and why it has become a standard in modern cryptography.

Authenticated versus Unauthenticated

While encryption helps secure data from someone trying to read it, it doesn’t necessarily prove that it was sent by the person claiming to have sent it. In other words, nothing verifies the integrity or authenticity of the ciphertext before decrypting it.

This means an attacker could intercept a request, create their own ciphertext, and forward that ciphertext instead. The receiving system would decrypt that ciphertext and assume that it came from the original sender, even though it’s coming from an attacker. The attacker never even has to decrypt the original sender’s ciphertext.

While we won’t get into the details of how this is done, using authenticated encryption instead would tell the receiving end that the message was tampered with, and it would reject that ciphertext.

Summary

1. ECB :- Individual block parallelly encrypted & decrypted
2. CBC :- Dependent on each other. support parallel decryption but not parallel encrypt

3. CFB:-

Conclusion:

Modes of operation are a critical component of how block ciphers function, dictating how encryption is applied across blocks of data. Selecting the wrong mode or implementing it incorrectly can lead to vulnerabilities that compromise the entire cryptographic system. Each mode, whether it’s ECB, CBC, CTR, or others, has its own strengths, weaknesses, and appropriate use cases, making it essential to choose the right one for the specific security requirements at hand.

Moreover, it’s crucial to understand the distinction between authenticated and unauthenticated encryption. While traditional encryption ensures data confidentiality, authenticated encryption (AE) not only protects the secrecy of the data but also ensures its integrity and authenticity, safeguarding against tampering and forgery. The use of authenticated encryption modes such as Galois/Counter Mode (GCM) is increasingly important in modern cryptography, especially in environments where data integrity is just as critical as confidentiality.

In summary, gaining a solid understanding of cryptographic modes of operation is vital for building secure systems. Whether you’re working on securing communications, protecting stored data, or building cryptographic protocols, ensure that you fully grasp the implications of each mode, their proper implementation, and when to apply authenticated encryption. With this foundation, you’re well-prepared to advance deeper into the fascinating world of cryptography and confidently implement robust security solutions.

Thank you for reading…