Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 0 down vote favorite

Given the wealth of vulnerabilities that have been found in CBC-constructions (Padding Oracle Attacks, BEAST, etc.), is there something else we should be using instead?

share|improve this question
I quite like CTR, because it's trivially parallelizable, simple to understand and implement, you only use the block cipher in one direction and there are no generic attacks against it except keystream reuse (which is thwarted by correct IV use) and birthday distinguisher (which is thwarted by large enough block sizes). – Thomas Nov 10 '12 at 5:20
However, this is more of a discussion question as users are likely to disagree with each other, so it might not be very good for SE's Q/A format. Furthermore, "better" is subjective as different cryptographic applications have different goals. – Thomas Nov 10 '12 at 5:20
CTR, of course, has a different IV requirement than CBC, so may not be easily swapped in, depending on the application. – Stephen Touset Nov 10 '12 at 6:27
Your question is unanswerable. Categorically there is not a mode which is better. It will depend on the details of the use case. Every mode has its advantages and disadvantages. Perhaps consider a specific application and post a new question based on that. – mikeazo♦ Nov 14 '12 at 14:22

closed as not constructive by Thomas, mikeazo♦ Nov 14 '12 at 14:22

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

1 Answer

up vote 0 down vote

Operation modes intrisically secure against Padding Oracle attacks are the ones that combine authentication and encryption, like GCM, CCM or SIV.

I would see BEAST not as a weakness of CBC per se, but of older SSL/TLS versions.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.