Problem - Kevin Tafuro

or similar mechanism is used. As with ECB, padding is required, unless messages are
always block-aligned.
CBC has been standardized by NIST.
The primary disadvantages of CBC mode are:
• Encryption cannot be parallelized (though decryption can be, and there are
encryption workarounds that break interoperability; see Recipe 5.14).
• There is no possibility of offline precomputation.
• Capture replay of entire or partial messages can be possible without additional
consideration.
• The mode requires an initial input that must be random. It is not sufficient to
use a unique but predictable value.
• The mode leaks more information than is optimal. We wouldn’t use it to output
more than 240 blocks.
• The primary advantage of CBC mode is that it captures the desirable properties
of ECB mode, while removing most of the drawbacks.
We discuss CBC mode in Recipe 5.6.
Counter (CTR) mode
Whereas ECB and CBC are block-based modes, counter (CTR) mode and the rest of
the modes described in this section simulate a stream cipher. That is, they use blockbased
encryption as an underlying primitive to produce a pseudo-random stream of
data, known as a keystream. The plaintext is turned into ciphertext by XOR’ing it
with the keystream.
CTR mode generates a block’s worth of keystream by encrypting a counter using
ECB mode. The result of the encryption is a block of keystream. The counter is then
incremented. Generally, the counter being publicly known is acceptable, though it’s
always better to keep it a secret if possible. The counter can start at a particular
value, such as zero, or something chosen at random, and increment by one every
time. (The initial counter value is a nonce, which is subtly different from an initialization
vector; see Recipe 4.9.) Alternatively, the counter can be modified every time
using a deterministic pseudo-random number generator that doesn’t repeat until all
possible values are generated. The only significant requirements are that the counter
value never be repeated and that both sides of an encryption channel know the order
in which to use counters. In practice, part of the counter is usually chosen randomly
at keying time, and part is sequential. Both parts help thwart particular kinds of
risks.
Despite being over 20 years old, CTR mode has only recently been standardized by
NIST as part of the AES standardization process.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Selecting a Cipher Mode | 165