# Block Cipher Modes

I have a question here asking the following:

Why do block ciphers need the use of blocking modes?

1. To encrypt messages larger than the size of the block.
2. To avoid having the same block ciphered into the same stream of bits twice.
3. To be able to parallelize some of the operations of ciphering or deciphering the message.
4. To increase the randomness of its PRP
5. To increase the computational complexity of a brute force approach

I get (3) as the solution because block ciphers do parallelize operations, for example ECB mode is fully parallelizable for both ciphering and deciphering of a message.

Can someone clarify that this is correct or if not, explain please? Thank you.

• And how do you handle messages that are larger than the block size otherwise? – DrLecter Oct 9 '14 at 21:11
• That's kind of what I'm kind of confused, the question is a bit vague. I'm not sure if block ciphers need the different modes juts for encrypting messages larger than block size – user51 Oct 9 '14 at 21:14
• Multiple of those answers are correct. – Stephen Touset Oct 9 '14 at 21:15
• If you ask general for modes. ECB is also a mode and does not help for 2), CBC is a mode and inherent sequential and does not help for 3). Same for 4) and 5) as IV is usually not secret. So if you are generally asking about modes I'd say that 1) holds irrespective of the particular mode. – DrLecter Oct 9 '14 at 21:23
• I would say 4 and 5 are incorrect, 2 and 3 are good properties for a block mode, but 1 is the raison d'être for block modes of operation. So I agree with DrLecter here. – Maarten Bodewes Oct 9 '14 at 23:51

To answer the question "why does a block cipher use a Mode of Operation", we need to first examine the question "what is a block cipher?"

A block cipher is a keyed operation that converts a string of N bits to a string of N bits (where N is usually fixed by the block cipher; for AES, N=128), in a way that, without the key, looks like a random permutation, but with the key, it can be efficiently computed, both forwards and backwards.

So, with this in mind, why do we use a "mode of operation?" Well, the answer is: when we want to use the block cipher to solve any problem other than converting a string of N bits into another string of N bits.

Some examples of these operations are:

• Encrypting a message which might not be precisely N bits long

• Possibly in a way that gives semantic security
• Possibly including a tweak
• Creating a message authentication code

• Doing both simultaneously (known as a "combined mode of operation")

• Generating a random looking bitstream

In light of this, let us look at your examples:

(1) and (2) are obvious requirements we may want from a transform; there certainly do exist modes with do those

(3) might be something we want from a mode of operation; there are modes that can be parallelized as well.

(4) I haven't heard of a mode of operation being designed specifically to do this (if a block cipher is distinguishable from a random permutation, we typically don't use it, rather than trying to design a mode of operation to mask it); however I can't see why a mode can't be used to achieve this.

(5) if one considers 3des as a "mode of operation" of des, well, I suppose we can force-bit these. IMHO, it feels like a bit of a stretch, but I can't think of any technical reason to disqualify it.

So, we see that we might use a mode of operation to do any of the things you listed; however (1) through (3) are far more common in practice.

• Regarding point 4, you could say that some "widening" modes increase randomness of the PRP if they offer security beyond $2^{n/2}$ blocks encrypted. – otus Oct 10 '14 at 6:58
• Concerning your (5) something like $E[k_1](m \oplus k_2) \oplus k_2$ might be a better example of a mode like algorithm increasing the brute force cost. – CodesInChaos Oct 10 '14 at 7:49