I want to know which "block cipher mode of operation" does the experts use? I don't want to use ECB or CBC because add padding and padding mess up my code. So which one does the experts use.


  • $\begingroup$ Nearly every encryption code (which is not a stream cipher) uses padding. It's possible to not need that, but I don't think you should implement crypto yourself if you can't work with padding. $\endgroup$ – Nova Jan 9 '15 at 16:57
  • $\begingroup$ I cant remove the padding after decryption (I use CBC, in PHP). Please give me a link or something... $\endgroup$ – tor Jan 9 '15 at 17:06
  • 3
    $\begingroup$ They use the mode that fits the requirements. Padding not working correctly is not a good reason to ditch CBC, you need to fix the code. Apart from padding there are several other things you'll need to get right, such as authentication/integrity checking and proper IV generation. Adding and removing padding is the easiest of these. $\endgroup$ – CodesInChaos Jan 9 '15 at 17:10

The modern trend for encryption-only modes is clearly CTR, which has a number of advantages over other modes:

  • no padding is needed (contrary to CBC);
  • the computationally-intensive part can be efficiently performed with the IV (and key) only, before the plaintext or ciphertext is available (contrary to CBC, CFB);
  • the computationally-intensive part can be efficiently performed on multiple CPUs (contrary to encryption with CBC, CFB; and both encryption and decryption with OFB);

However one often wants to use authenticated encryption rather than encryption. I would not say that the dust has quite settled on which authenticated encryption mode is best, but one could do worst than choose GCM.

The authenticated modes of encryption CCM, GCM and EAX all use CTR internally to provide confidentiality, which confirms the trend to use CTR.

  • 4
    $\begingroup$ The only real downside to CTR is that accidental IV reuse is absolutely catastrophic. $\endgroup$ – Stephen Touset Jan 9 '15 at 18:27
  • $\begingroup$ Are you aware of SW implementations actually exploiting your last two points? I'm curious, not critical, although I think CBC with ciphertext stealing is underestimated. $\endgroup$ – Ruggero Jan 9 '15 at 23:28
  • $\begingroup$ Same issue with IV reuse for GCM mode actually. GCM uses CTR internally (just like CCM and EAX do). Choosing GCM, CCM or EAX also means you are implicitly choosing CTR mode for confidentiality. Je suis Charlie ausi. $\endgroup$ – Maarten Bodewes Jan 10 '15 at 2:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.