Slides · 15 slides
Modes of operation & AEAD: ECB, CBC, CTR, GCM & ChaCha20-Poly1305
The same module told visually, ready to present. Speaker notes carry the full explanation.
Symmetric
Modes of operation & AEAD
AES encrypts 16 bytes. Everything else comes from the mode around it, and that's where most real breaks happen
The yardstick
Deterministic encryption can't be secure
Every secure mode needs a fresh IV or nonce per message
The penguin
ECB keeps every equality
The same picture under three AES modes, encrypted for real in your browser
Each image is 160×160 RGBA pixels, 4 bytes each, so one 16-byte AES block is exactly four pixels side by side. The ciphertext bytes are drawn as pixels with the alpha byte set back to opaque. All three modes use Web Crypto. It has no ECB mode on purpose, so ECB here is AES-CBC on one block at a time with an all-zero IV, which is the same thing as raw AES on that block.
Chaining
CBC needs an unpredictable IV
BEAST (2011) exploited TLS 1.0's predictable IVs
Counter mode
CTR: fast, parallel, malleable
Special purposes
CFB, OFB and XTS
XTS protects a lost laptop, not storage an attacker can watch or write
Same shape out
Format-preserving encryption
Integrity
Three ways to combine a cipher and a MAC
Bellare and Namprempre, 2000
The right answer, packaged
AEAD: seal or fail
AES-GCM
GCM's hard limits
TLS 1.3 sidesteps randomness: nonce = sequence number xor per-connection IV
The software AEAD
ChaCha20-Poly1305
Constant time in plain software; XChaCha20 stretches the nonce to 192 bits
Nonce misuse
SIV fails gracefully
Choosing
Which mode for a new design
Legacy code
Closing ECB and CBC oracles
Advanced · Vaudenay 2002
A padding oracle, one byte at a time
Hit SSL 3.0 (POODLE), ASP.NET, and TLS CBC via timing (Lucky Thirteen)
Keys: ← → move, F full screen, G all slides, N notes