Problem - Kevin Tafuro

implementation. If you need code that implements CBC mode, you will find it in the
following discussion.
Discussion
You should probably use a higher-level abstraction, such as the one
discussed in Recipe 5.16. Use a raw mode only when absolutely necessary,
because there is a huge potential for introducing a security vulnerability
by accident. If you still want to use CBC, be sure to use a
message authentication code with it (see Chapter 6).
CBC mode is a way to use a raw block cipher and, if used properly, it avoids all the
security risks associated with using the block cipher directly. CBC mode works on a
message in blocks, where blocks are a unit of data on which the underlying cipher
operates. For example, AES uses 128-bit blocks, whereas older ciphers such as DES
almost universally use 64-bit blocks.
See Recipe 5.4 for a discussion of the advantages and disadvantages of this mode, as
well as a comparison to other cipher modes.
CBC mode works (as illustrated in Figure 5-1) by taking the ciphertext output for the
previous block, XOR’ing that with the plaintext for the current block, and encrypting
the result with the raw block cipher. The very first block of plaintext gets XOR’d
with an initialization vector, which needs to be randomly selected to ensure meeting
security goals but which may be publicly known.
Many people use sequential IVs or even fixed IVs, but that is not at all
recommended. For example, SSLhas had security problems in the past
when using CBC without random IVs. Also note that if there are common
initial strings, CBC mode can remain susceptible to dictionary
attacks if no IV or similar mechanism is used. As with ECB, padding is
required unless messages are always block-aligned.
Many libraries already come with an implementation of CBC mode for any ciphers
they support. Some don’t, however. For example, you may only get an implementation
of the raw block cipher when you obtain reference code for a new cipher.
Generally, CBC mode requires padding. Because the cipher operates on block-sized
quantities, it needs to have a way of handling messages that do not break up evenly
into block-sized parts. This is done by adding padding to each message, as described
in Recipe 5.11. Padding always adds to the length of a message. If you wish to avoid
message expansion, you have a couple of options. You can ensure that your messages
always have a length that is a multiple of the block size; in that case, you can
simply turn off padding. Otherwise, you have to use a different mode. See Recipe 5.4
for our mode recommendations. If you’re really a fan of CBC mode, you can sup-
176 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.