I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with electronic codebook.

But what I'm missing, is some sort of comparison table with all the other modes so I understand the positives and negatives of the various modes. Where can I find this information so I can make an informed decision on what mode to use?

Update 1:

Looks like OpenSSL's EVP api (which I believe is the recommended API when using OpenSSL?) only supports 2 modes [OpenSSL][1] – GCM and CCM – which drastically reduces my choices.

1: https://www.openssl.org/docs/crypto/EVP_EncryptInit.html

Update 2:

Unsurprisingly, that OpenSSL page is somewhat misleading or incomplete. Looking at /usr/include/openssl/evp.h I see there are 30+ variations on AES to choose from, including:

  • EVP_aes_*_ecb()
  • EVP_aes_*_cbc()
  • EVP_aes_*_cfb1()
  • EVP_aes_*_ofb()
  • EVP_aes_*_ctr()
  • EVP_aes_*_xts()
  • ...and many more!

So I'm back to reading about all the different modes so I can make a semi-intelligent choice as to which I should be using.

  • 4
    $\begingroup$ The reason such a table does not exist (and should not) is that there are so many different use cases and a table could only cover some small subset of use cases. For example, block ciphers were traditionally used to provide confidentiality. Many use cases, however, would also require integrity. Do you have some other way to provide integrity (e.g., HMAC) or do you need that to come directly from the block cipher? The answer to that question will completely change which mode would be the recommended. $\endgroup$ – mikeazo Jun 22 '14 at 0:24

Encryption modes have lots of differences. Putting all of them in a table would be tricky. I would recommend you to do some work and read through the NIST documentation on Block cipher modes.

If you are unsure and you don't have particular requirements, you could check if GCM mode is available. It is an authenticated mode that also provides the integrity/authenticity of the ciphertext. Don't forget to include the IV (and other configuration data stored with the ciphertext) in the AAD though.

In the end, all modes described by NIST - except of course ECB mode, note the NIST hint - are currently safe for providing confidentiality, when used correctly. So in that sense there is little point in comparing them.

|improve this answer|||||
  • $\begingroup$ If a table is created, then you need to be able to understand the table. E.g. "succeptible to padding oracle attacks (Y/N) is nice", but you would have to understand padding mode attacks. In that case you are very likely to understand the crypto modes already. $\endgroup$ – Maarten Bodewes Jun 22 '14 at 0:38
  • $\begingroup$ Anything missing from my answer, Stéphane? $\endgroup$ – Maarten Bodewes Jul 13 '14 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.