Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with electronic codebook.

But what I'm missing, is some sort of comparison table with all the other modes so I understand the positives and negatives of the various modes. Where can I find this information so I can make an informed decision on what mode to use?

Update 1:

Looks like OpenSSL's EVP api (which I believe is the recommended API when using OpenSSL?) only supports 2 modes [OpenSSL][1] – GCM and CCM – which drastically reduces my choices.


Update 2:

Unsurprisingly, that OpenSSL page is somewhat misleading or incomplete. Looking at /usr/include/openssl/evp.h I see there are 30+ variations on AES to choose from, including:

  • EVP_aes_*_ecb()
  • EVP_aes_*_cbc()
  • EVP_aes_*_cfb1()
  • EVP_aes_*_ofb()
  • EVP_aes_*_ctr()
  • EVP_aes_*_xts()
  • ...and many more!

So I'm back to reading about all the different modes so I can make a semi-intelligent choice as to which I should be using.

share|improve this question
The reason such a table does not exist (and should not) is that there are so many different use cases and a table could only cover some small subset of use cases. For example, block ciphers were traditionally used to provide confidentiality. Many use cases, however, would also require integrity. Do you have some other way to provide integrity (e.g., HMAC) or do you need that to come directly from the block cipher? The answer to that question will completely change which mode would be the recommended. – mikeazo Jun 22 '14 at 0:24

Encryption modes have lots of differences. Putting all of them in a table would be tricky. I would recommend you to do some work and read through the NIST documentation on Block cipher modes.

If you are unsure and you don't have particular requirements, you could check if GCM mode is available. It is an authenticated mode that also provides the integrity/authenticity of the ciphertext. Don't forget to include the IV (and other configuration data stored with the ciphertext) in the AAD though.

In the end, all modes described by NIST - except of course ECB mode, note the NIST hint - are currently safe for providing confidentiality, when used correctly. So in that sense there is little point in comparing them.

share|improve this answer
If a table is created, then you need to be able to understand the table. E.g. "succeptible to padding oracle attacks (Y/N) is nice", but you would have to understand padding mode attacks. In that case you are very likely to understand the crypto modes already. – Maarten Bodewes Jun 22 '14 at 0:38
Anything missing from my answer, Stéphane? – Maarten Bodewes Jul 13 '14 at 12:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.