What is the difference between a 'cipher' and a 'mode of operation'?

Question

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)?

Aren't these both terms for the encryption/decryption technique?

Answer 1

A mode of operation is an explicit method by which we use a block cipher (eg AES) to do more than just encrypt one block of data. For example, it may allow us to encrypt multiple blocks of data (eg ECB,CBC etc), provide us with some authenticated encryption (eg GCM) or a method for encrypting disc storage (eg XTS).

---

Rijndael,DES etc are block ciphers. That means they provide a method for encrypting a fixed amount of data (in the case of AES, they encrypt blocks on 128 bits).

In practice, the amount of data you want to encrypt is often much larger than the block size. So, we either need to create more and more block ciphers of almost every size, or we come up with a way of using our block cipher to encrypt larger amounts of data. This method is called a mode of operation.

To use the most simple case as an example, consider AES in ECB mode. ECB mode tells us that we need split our plaintext string into sections of 128 bits (possibly after some padding scheme). Then, each section is encrypted using AES, and the resultant encryptions are then concatenated to form our output ciphertext. AES simply performs encryptions of the plaintext blocks we give it, whereas ECB allows us to encrypt arbitrarily large amounts of data.

---

For descriptions of many different modes of operation and a discussion of their merits/weaknesses, you might be interested in this paper by Rogaway, and section 2.3 provides his formalisation of a mode of operation.

Answer 2

A "cipher" is the algorithm which encrypts and decrypts data, while the "cipher-mode" defines how the cipher encrypts and decrypts it.

In other words: ciphers are the cryptographic algorithms that you use to encrypt/decrypt data, while cipher-modes define the "mode of operation" for applying the cipher. Both are complementary and can be chosen separately.

In fact, you could think of it like this: if you choose a cipher it's like choosing what car you want to drive, while choosing a cipher-mode defines how you want to drive that car.

What might be interesting for you to know: if you do not choose a specific cipher-mode, you'll always find yourself using the default cipher-mode called "ECB" (Electronic CodeBook).

For an overview of different cipher-modes, I would like to point you to Wikipedia's "Block cipher modes of operation" article.

Last but not least, here are two examples I've quickly wrapped up to show you where exactly the "cipher" plays a role, and where the "cipher-mode" comes in:

---

ECB
^{(The default, classic mode of encryption/decryption; but not really recommended due to potential security issues.)}

---

CBC
^{(One of many cipher-mode options that - compared to ECB - represents a safer encryption/decryption mode.)}

Answer 3

In general, a cipher is simply any algorithm for encrypting data. It's a really broad term, and might cover anything from ancient substitution ciphers like the Caesar cipher to modern-day public-key ciphers like RSA.

In modern cryptography, there are two commonly encountered types of symmetric (i.e. not public-key) ciphers: block ciphers and stream ciphers. A block cipher encrypts a block of, say, 64 or 128 bits of data, mapping it to another such block of the same size. AES, a.k.a. Rijndael, is one well known example of a block cipher. A stream cipher, on the other hand, can encrypt an arbitrarily long stream of bits, turning it into another (typically slightly longer) bitstream. The RC4 algorithm is a fairly well known example of a a stream cipher.

On its own, a block cipher is obviously not nearly as useful as a stream cipher, at least unless you just happen to need to encrypt some very short messages that fit inside one block. However, it turns out that block ciphers are a lot more versatile than stream ciphers as building blocks of other cryptographic tools, such as hash functions and message authentication codes. Also, there's an extensive body of research on the construction and cryptanalysis of block ciphers, whereas relatively little is known about what makes a dedicated stream cipher (i.e. one not based on a block cipher) secure. Thus, with the exception of a few dedicated stream ciphers like those in the eSTREAM portfolio, almost all modern cipher design and analysis effort is focused on block ciphers.

But for practical encryption, you still want a stream cipher. This is where the modes of operation come in. Basically, a mode of operation is a method for turning a block cipher into a stream cipher.

For example, if you want to encrypt a bunch of text with AES, you don't use the AES block cipher directly — the text probably wouldn't fit inside one AES block anyway. Instead, you use a stream cipher built from AES using a suitable mode of operation, such as AES-CBC or AES-CTR, or even an authenticated encryption mode like AES-GCM or AES-SIV.

The nice thing about building stream ciphers out of block ciphers like that is that we can prove the security of the resulting stream cipher (in the sense of ciphertext indistinguishability under an appropriate attack model), provided that the underlying block cipher satisfies its own security assumptions (basically, is a pseudorandom permutation). Since we know a lot more about designing secure block ciphers than we know about stream ciphers in general, this is a very attractive feature. Also, as noted above, the same block cipher can be used in other ways to construct many other useful cryptographic tools, which also enjoy similarly provable security.

Answer 4

I think cipher can mean several things.

Mainly we think here of the cipher as the algorithm that changes plaintext into ciphertext, creating confidentiality of the plaintext. If the term is used in that context, then a cipher is the combination of a mode of operation, configured using a block cipher and an optional padding mode. Alternatively it could be a stream cipher (stream ciphers do not require either a mode of operation or padding mode - in general).

On the other hand we sometimes also use the word cipher for cryptographic primitives. It would be a bit weird to say that a block cipher such as AES is not a cipher. But as it is not secure in the cryptographic sense, we normally use the word "cipher" as indicated in the first section of the answer. However, it seems that you're targeting this definition from the question.

I guess then the final answer will be: "a mode of operation can be used with a block cipher and optional padding mode to create a cipher". This neatly covers both possibilities.

---

Of if you want to make the main differences explicit:

• a block cipher securely encrypts (permutes) single blocks of plaintext given a random key - because the key is not reusable it is not CPA secure;
• a mode of operation configured with a block cipher and padding mode and and IV can encrypt plaintext between 0 bytes and a (high) maximum input size, and may do so using multiple keys, it should be CPA secure;