4
$\begingroup$

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with electronic codebook.

But what I'm missing, is some sort of comparison table with all the other modes so I understand the positives and negatives of the various modes. Where can I find this information so I can make an informed decision on what mode to use?

Update 1:

Looks like OpenSSL's EVP api (which I believe is the recommended API when using OpenSSL?) only supports 2 modes [OpenSSL][1] – GCM and CCM – which drastically reduces my choices.

1: https://www.openssl.org/docs/crypto/EVP_EncryptInit.html

Update 2:

Unsurprisingly, that OpenSSL page is somewhat misleading or incomplete. Looking at /usr/include/openssl/evp.h I see there are 30+ variations on AES to choose from, including:

  • EVP_aes_*_ecb()
  • EVP_aes_*_cbc()
  • EVP_aes_*_cfb1()
  • EVP_aes_*_ofb()
  • EVP_aes_*_ctr()
  • EVP_aes_*_xts()
  • ...and many more!

So I'm back to reading about all the different modes so I can make a semi-intelligent choice as to which I should be using.

Improve this question
$\endgroup$
1
  • 4
    $\begingroup$ The reason such a table does not exist (and should not) is that there are so many different use cases and a table could only cover some small subset of use cases. For example, block ciphers were traditionally used to provide confidentiality. Many use cases, however, would also require integrity. Do you have some other way to provide integrity (e.g., HMAC) or do you need that to come directly from the block cipher? The answer to that question will completely change which mode would be the recommended. $\endgroup$
    – mikeazo
    Jun 22, 2014 at 0:24

1 Answer 1

Reset to default
4
$\begingroup$

Encryption modes have lots of differences. Putting all of them in a table would be tricky. I would recommend you to do some work and read through the NIST documentation on Block cipher modes.

If you are unsure and you don't have particular requirements, you could check if GCM mode is available. It is an authenticated mode that also provides the integrity/authenticity of the ciphertext. You can also add any other non-confidential data such as configuration data in the Additional Authenticated Data (AAD) - this is separate input to the cipher. Beware that GCM mode fails catastrophically to IV nonce / reuse (GCM-SIV mode could correct that).

In the end, all modes described by NIST - except of course ECB mode, note the NIST hint - are secure for providing confidentiality when used correctly. So in that sense there is little point in comparing them without going into the specific use case.

[EDIT] I've removed the requirement that the IV needed to be put in the AAD data. I don't know what I was thinking when I wrote that and I didn't get corrected...

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.