Problem - Kevin Tafuro

Electronic Code Book (ECB) mode
This mode simply breaks up a message into blocks and directly encrypts each block
with the raw encryption operation. It does not have any desirable security properties
and should not be used under any circumstances. We cover raw encryption as a
building block for building other modes, but we don’t cover ECB itself because of its
poor security properties.
ECB has been standardized by NIST (the U.S. National Institute for Standards and
Technology).
The primary disadvantages of ECB mode are:
• Encrypting a block of a fixed value always yields the same result, making ECB
mode particularly susceptible to dictionary attacks.
• When encrypting more than one block and sending the results over an untrusted
medium, it is particularly easy to add or remove blocks without detection (that
is, ECB is susceptible to tampering, capture replay, and other problems). All
other cipher modes that lack integrity checking have similar problems, but ECB
is particularly bad.
• The inputs to the block cipher are never randomized because they are always
exactly equal to the corresponding block of plaintext.
• Offline precomputation is feasible.
The mode does have certain advantages, but do note that other modes share these
advantages:
• Multiblock messages can be broken up, and the pieces encrypted in parallel.
• Random access of messages is possible; the 1,024th block can be decrypted
without decrypting other data blocks.
However, the advantages of ECB do not warrant its use.
We do discuss how to use ECB to encrypt a block at a time in Recipe 5.5, when it is
necessary in implementing other cryptographic primitives.
Cipher Block Chaining (CBC) mode
CBC mode is a simple extension to ECB mode that adds a significant amount of
security. CBC works by breaking the message up into blocks, then using XOR to
combine the ciphertext of the previous block with the plaintext of the current block.
The result is then encrypted in ECB mode. The very first block of plaintext is XOR’d
with an initialization vector (IV). The IV can be publicly known, and it must be randomly
selected for maximum security. Many people use sequential IVs or even fixed
IVs, but that is not at all recommended. For example, SSLhas had security problems
in the past when using CBC without random IVs. Also note that if there are common
initial strings, CBC mode can remain susceptible to dictionary attacks if no IV
164 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.