Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?

share|improve this question
9  
About every mode of operation is better than ECB for most use-cases. –  Paŭlo Ebermann Jul 21 '11 at 14:25
    
Authenticated modes of operation add a lot of security for many use cases (as specified by the answer of DW). If padding oracle attacks are possible, CBC mode of operations does not offer security regardless of the cipher used. –  Maarten Bodewes - owlstead Sep 18 '13 at 16:13

4 Answers 4

up vote 39 down vote accepted

The really simple explanation for the difference between the two is this:

  • ECB (electronic code book) is basically raw cipher. For each block of input, you encrypt the block and get some output. The problem with this transform is that any resident properties of the plaintext might well show up in the ciphertext – possibly not as clearly – that's what blocks and key schedules are supposed to protect againt, but analyzing the patterns you may be able to deduce properties that you otherwise thought were hidden.
  • CBC mode is short for cipher block chaining. You have an initialization vector which you XOR the first block of plaintext against. You then encrypt that block of plaintext. The next block of plaintext is xor'd against the last encrypted block before you encrypt this block. enter image description here (Public domain image from Wikimedia Commons.)

The advantages of CBC over ECB are many – with ECB, assuming many things, you could manage a partial decryption and easily fill in the blanks, for example if extracting data from an encrypted hard disk. With CBC, if you are missing a few blocks in the sequence encryption becomes impossible. However, there is one downside to CBC – ECB naturally supports operation in parallel since each block can be encrypted independently of the next. However, with CBC this is harder, since you have to wait on each block. (You can still parallelize decryption, though.)

CBC itself can also be considered vulnerable in certain situations, specifically the use of predictable IVs and unauthenticated decryption can allow you to guess plaintexts as explained in this answer and in more detail here.

The IV problem is resolved by using unpredictable (cryptographically random) IVs. The authentication problem is traditionally resolved using message authentication codes - however, implementation of these is not perfect. Dedicated modes have been invented which tackle the issue of authentication too, for example EAX and Galois Counter Mode.

Other modes exist to deal with specific scenarios, e.g.:

  • Counter Mode uses the fact that a block cipher's output in ECB mode should be indistinguishable from random, and XOR's the result of encrypting a counter+iv combination as a stream cipher.
  • XTS is a mode of operation used in disk encryption.

The key point to take away is that each mode has a number of merits and implementation concerns and these must be weighed up carefully (and correctly implemented). And, where possible, avoid ECB.

share|improve this answer
    
This is an accepted answer, but it does not answer the second part of the question. We should either remove this part of the question, or we should at least point to authenticated modes of operation within the answer. –  Maarten Bodewes - owlstead Sep 18 '13 at 16:14
    
@owlstead I'll expand on it, give me a bit. –  Ninefingers Sep 19 '13 at 7:19

ECB is not secure, it leaks information. CBC is better. But if you need random access to your file Use CTR mode.

For more information about Block cipher modes of operation see the Wikipedia article.

share|improve this answer
3  
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. "ECB is not secure, it leaks information" is a conclusion, but not including what's going on that makes that the right conclusion puts us in a "give a man a fish" vs. "teach a man to fish" scenario -- it's always better to teach him to fish. :) –  HedgeMage Jul 25 '11 at 17:51

ECB and CBC are only about encryption. Most situations which call for encryption also need, at some point, integrity checks (ignoring the threat of active attackers is a common mistake). There are combined modes which do encryption and integrity simultaneously; see EAX and GCM (see also OCB, but this one has a few lingering patent issues; assuming that software patents apply at all to your situation -- a non-trivial question --, then there are some explicit licenses).

share|improve this answer

Never use ECB! It is insecure.

I recommend an authenticated encryption mode, like EAX or GCM. If you can't use authenticated encryption, use CBC or CTR mode encryption, and then apply a MAC (e.g., AES-CMAC or SHA1-HMAC) to the resulting ciphertext.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.