Problem - Kevin Tafuro

can arise. For general-purpose use, we recommend a high-level abstraction, such as
that discussed in Recipe 5.16.
With that out of the way, we’ll note that each cipher mode has its advantages and
drawbacks. Certain drawbacks are common to all of the popular cipher modes and
should usually be solved at another layer. In particular:
• If a network attack destroys or modifies data in transit, any cipher mode that
does not perform integrity checking will, if the attacker does his job properly, fail
to detect an error. The modes we discuss that provide built-in integrity checking
are CWC, CCM, and OCB.
• When an attacker does tamper with a data stream by adding or truncating, most
modes will be completely unable to recover. In some limited circumstances, CFB
mode can recover, but this problem is nonetheless better solved at the protocol
layer.
• Especially when padding is not necessary, the ciphertext length gives away information
about the length of the original message, which can occasionally be useful
to an attacker. This is a covert channel, but one that most people choose to
ignore. If you wish to eliminate risks with regard to this problem, pad to a large
length, even if padding is not needed. To get rid of the risk completely, send
fixed-size messages at regular intervals, whether or not there is “real” data to
send. Bogus messages to eliminate covert channels are called cover traffic.
• Block ciphers leak information about the key as they get used. Some block
cipher modes leak a lot more information than others. In particular, CBC mode
leaks a lot more information than something like CTR mode.
If you do not use a cipher mode that provides built-in integrity checking,
be sure to use a MAC (message authentication code) whenever
encrypting.
In the following sections, we’ll go over the important properties of each of the most
popular modes, pointing out the tradeoffs involved with each (we’ll avoid discussing
the details of the modes here; we’ll do that in later recipes). Note that if a problem is
listed for only a single cipher mode and goes unmentioned elsewhere, it is not a
problem for those other modes. For each of the modes we discuss, speed is not a significant
concern; the only thing that has a significant impact on performance is the
underlying block cipher. *
* Integrity-aware modes will necessarily be slower than raw encryption modes, but CWC and OCB are faster
than combining an integrity primitive with a standard mode, and CCM is just as fast as doing so.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Selecting a Cipher Mode | 163