Security Articles from Wikipedia

Block cipher modes of operation 13
Block cipher modes of operation
In cryptography, modes of operation is the procedure of enabling the repeated and secure use of a block cipher
under a single key. [1][2] A block cipher by itself allows encryption only of a single data block of the cipher's block
length. When targeting a variable-length message, the data must first be partitioned into separate cipher blocks.
Typically, the last block must also be extended to match the cipher's block length using a suitable padding scheme. A
mode of operation describes the process of encrypting each of these blocks, and generally uses randomization based
on an additional input value, often called an initialization vector, to allow doing so safely. [1]
Modes of operation have primarily been defined for encryption and authentication. [1][3] Historically, encryption
modes have been studied extensively in regard to their error propagation properties under various scenarios of data
modification. Later development regarded integrity protection as an entirely separate cryptographic goal from
encryption. Some modern modes of operation combine encryption and authentication in an efficient way, and are
known as authenticated encryption modes. [2]
While modes of operation are commonly associated with symmetric encryption, [2] they may also be applied to
public-key encryption primitives such as RSA in principle (though in practice public-key encryption of longer
messages is generally realized using hybrid encryption). [1]
History and standardization
The earliest modes of operation, ECB, CBC, OFB, and CFB (see below for all), date back to 1981 and were
specified in FIPS 81 [4] , DES Modes of Operation. In 2001, NIST revised its list of approved modes of operation by
including AES as a block cipher and adding CTR mode in SP800-38A [5] , Recommendation for Block Cipher Modes
of Operation. Finally, in January, 2010, NIST added XTS-AES in SP800-38E [6] , Recommendation for Block Cipher
Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices. Other confidentiality modes exist
which have not been approved by NIST. For example, CTS is ciphertext stealing mode and available in many
popular cryptographic libraries.
ECB, CBC, OFB, CFB, CTR, and XTS modes only provide confidentiality; to ensure an encrypted message is not
accidentally modified or maliciously tampered requires a separate message authentication code such as CBC-MAC.
The cryptographic community recognized the need for dedicated integrity assurances and NIST responded with
HMAC, CMAC, and GMAC. HMAC was approved in 2002 as FIPS 198 [7] , The Keyed-Hash Message
Authentication Code (HMAC), CMAC was released in 2005 under SP800-38B [8] , Recommendation for Block
Cipher Modes of Operation: The CMAC Mode for Authentication, and GMAC was formalized in 2007 under
SP800-38D [9] , Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC.
After observing that compositing a confidentiality mode with an authenticity mode could be difficult and error prone,
the cryptographic community began to supply modes which combined confidentiality and data integrity into a single
cryptographic primitive. The modes are referred to as authenticated encryption, AE or authenc. Examples of authenc
modes are CCM (SP800-38C [10] ), GCM (SP800-38D [9] ), CWC, EAX, IAPM, and OCB.
Modes of operation are nowadays defined by a number of national and internationally recognized standards bodies.
The most influential source is the US NIST. Other notable standards organizations include the ISO, the IEC, the
IEEE, the national ANSI, and the IETF.