What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)?

Aren't these both terms for the encryption/decryption technique?

-
No, Rijndael is a cryptographic primitive that you can do things with, a mode of operation is the method of using it. It is like saying that your block cipher is SUGAR, and the mode of operation is COOKIES or M&MS – Richie Frame Oct 18 '13 at 7:00

A mode of operation is an explicit method by which we use a block cipher (eg AES) to do more than just encrypt one block of data. For example, it may allow us to encrypt multiple blocks of data (eg ECB,CBC etc), provide us with some authenticated encryption (eg GCM) or a method for encrypting disc storage (eg XTS).

Rijndael,DES etc are block ciphers. That means they provide a method for encrypting a fixed amount of data (in the case of AES, they encrypt blocks on 128 bits).

In practice, the amount of data you want to encrypt is often much larger than the block size. So, we either need to create more and more block ciphers of almost every size, or we come up with a way of using our block cipher to encrypt larger amounts of data. This method is called a mode of operation.

To use the most simple case as an example, consider AES in ECB mode. ECB mode tells us that we need split our plaintext string into sections of 128 bits (possibly after some padding scheme). Then, each section is encrypted using AES, and the resultant encryptions are then concatenated to form our output ciphertext. AES simply performs encryptions of the plaintext blocks we give it, whereas ECB allows us to encrypt arbitrarily large amounts of data.

For descriptions of many different modes of operation and a discussion of their merits/weaknesses, you might be interested in this paper by Rogaway, and section 2.3 provides his formalisation of a mode of operation.

-
Paper? More like a novel! But an exceptionally good paper/novel all the same... – Reid Oct 18 '13 at 19:11

A "cipher" is the algorithm which encrypts and decrypts data, while the "cipher-mode" defines how the cipher encrypts and decrypts it.

In other words: ciphers are the cryptographic algorithms that you use to encrypt/decrypt data, while cipher-modes define the "mode of operation" for applying the cipher. Both are complementary and can be chosen separately.

In fact, you could think of it like this: if you choose a cipher it's like choosing what car you want to drive, while choosing a cipher-mode defines how you want to drive that car.

What might be interesting for you to know: if you do not choose a specific cipher-mode, you'll always find yourself using the default cipher-mode called "ECB" (Electronic CodeBook).

For an overview of different cipher-modes, I would like to point you to Wikipedia's "Block cipher modes of operation" article.

Last but not least, here are two examples I've quickly wrapped up to show you where exactly the "cipher" plays a role, and where the "cipher-mode" comes in:

ECB
(The default, classic mode of encryption/decryption; but not really recommended due to potential security issues.)

CBC
(One of many cipher-mode options that - compared to ECB - represents a safer encryption/decryption mode.)

-
"ciphers are the cryptographic algorithms that you use to secure data" - sorry if this is overly critical, but I think this sentence is unclear. Arguably the mode-of-operation is also the algorithm "you" use to secure data, the cipher is the algorithm that the mode uses to ensure it's secure? As such, I don't think this helps explain the distinction. Other than that, very nice answer (good idea to use the diagrams) – figlesquidge Oct 18 '13 at 15:39
@user2883315 As long as we both agree that the "cipher" is the algorithm that encrypts/decrypts your data, while the "cipher-mode" defines the mode of operation for applying the cipher, we're fine. ;) I reworded that line a bit to avoid potential confusion. Thanks for the heads-up… – e-sushi Oct 18 '13 at 17:59

In general, a cipher is simply any algorithm for encrypting data. It's a really broad term, and might cover anything from ancient substitution ciphers like the Caesar cipher to modern-day public-key ciphers like RSA.

In modern cryptography, there are two commonly encountered types of symmetric (i.e. not public-key) ciphers: block ciphers and stream ciphers. A block cipher encrypts a block of, say, 64 or 128 bits of data, mapping it to another such block of the same size. AES, a.k.a. Rijndael, is one well known example of a block cipher. A stream cipher, on the other hand, can encrypt an arbitrarily long stream of bits, turning it into another (typically slightly longer) bitstream. The RC4 algorithm is a fairly well known example of a a stream cipher.

On its own, a block cipher is obviously not nearly as useful as a stream cipher, at least unless you just happen to need to encrypt some very short messages that fit inside one block. However, it turns out that block ciphers are a lot more versatile than stream ciphers as building blocks of other cryptographic tools, such as hash functions and message authentication codes. Also, there's an extensive body of research on the construction and cryptanalysis of block ciphers, whereas relatively little is known about what makes a dedicated stream cipher (i.e. one not based on a block cipher) secure. Thus, with the exception of a few dedicated stream ciphers like those in the eSTREAM portfolio, almost all modern cipher design and analysis effort is focused on block ciphers.

But for practical encryption, you still want a stream cipher. This is where the modes of operation come in. Basically, a mode of operation is a method for turning a block cipher into a stream cipher.

For example, if you want to encrypt a bunch of text with AES, you don't use the AES block cipher directly — the text probably wouldn't fit inside one AES block anyway. Instead, you use a stream cipher built from AES using a suitable mode of operation, such as AES-CBC or AES-CTR, or even an authenticated encryption mode like AES-GCM or AES-SIV.

The nice thing about building stream ciphers out of block ciphers like that is that we can prove the security of the resulting stream cipher (in the sense of ciphertext indistinguishability under an appropriate attack model), provided that the underlying block cipher satisfies its own security assumptions (basically, is a pseudorandom permutation). Since we know a lot more about designing secure block ciphers than we know about stream ciphers in general, this is a very attractive feature. Also, as noted above, the same block cipher can be used in other ways to construct many other useful cryptographic tools, which also enjoy similarly provable security.

-