THE GARDEN

Block Cipher Mode of Operation

Updated 19 Sep 2026

• •

  What it is

  • •

    A block cipher like AES only encrypts one fixed-size block at a time. A "mode of operation" defines how to chain many block operations together to encrypt an arbitrary-length message, and different modes have very different security properties — most real-world "AES attacks" are actually attacks on the surrounding mode, not on AES itself.

• •

  When to apply

  • •

    Reference this whenever a challenge names or implies a specific mode (AES.MODE_ECB, MODE_CBC, MODE_CTR, MODE_OFB) so you know which attack family (linked below) is even in scope.

• •

  Worked example

  • •

    Toy one-byte CBC: let $IV=0x10$ and the block-decryption oracle return $D_K(C_1)=0x53$. Then $P_1=0x53\oplus0x10=0x43$, ASCII C. For the next block, XOR $D_K(C_2)$ with $C_1$ rather than with the IV.

• •

  The modes

  • •

    ECB (Electronic Codebook) — each block encrypted independently with no chaining. Identical plaintext blocks always produce identical ciphertext blocks, which both leaks structure and enables ECB Byte-at-a-Time Decryption Attack.

  • •

    CBC (Cipher Block Chaining) — each plaintext block is XORed with the previous ciphertext block (or the IV, for the first block) before encrypting: $C_i = E_K(P_i \oplus C_{i-1})$, so $P_i = D_K(C_i) \oplus C_{i-1}$. This chaining enables AES CBC Bit-Flipping, CBC Decryption via ECB Oracle, and CBC IV=Key Recovery Attack when misused.

  • •

    CTR (Counter) — turns the block cipher into a stream cipher: encrypt an incrementing counter (seeded by a nonce) to produce a keystream, then XOR it with the plaintext. Never reuse a (key, counter) pair — see Known-Plaintext Keystream Recovery (Many-Time Pad).

  • •

    OFB (Output Feedback) — also a stream cipher: repeatedly encrypt the IV to build a keystream (each output feeds into the next encryption), then XOR with plaintext. Because keystream generation is independent of the plaintext, encryption and decryption are literally the same function — see OFB Mode Encryption-Decryption Symmetry.

  • •

    CFB (Cipher Feedback) — similar stream-cipher construction to OFB, but feeds back the ciphertext rather than the raw cipher output; not directly used in these solves but worth knowing it exists alongside OFB/CTR.

• •

  Python

  • •

     from Crypto.Cipher import AES
    cipher = AES.new(key, AES.MODE_CBC, iv)   # or MODE_ECB, MODE_CTR(counter=...), MODE_OFB
    

• •

  Related

  • •

    AES

• •

  Cards

  • •

    Which two modes covered here turn a block cipher into a stream cipher?

    • •

      CTR and OFB (both generate a keystream independent of the plaintext and XOR it in).

  • •

    What CBC property makes bit-flipping attacks possible?

    • •

      Each plaintext block is XORed with the previous ciphertext block during decryption, so flipping bits in one ciphertext block flips the same bits in the next decrypted plaintext block.

◌ Explore connections in Graph view