# Why are modes of operation used, what attacks do they prevent?

I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are

Now I know if i do not use a mode of operation every time i encrypt the same plain text (abc) with the same key (klm) i get the same cipher text (zyx). the IV in a mode of operation prevents this from happening. But since abc always maps to zyx with the key klm there are some attacks to figure out what key is used.

What attacks can be used against only block ciphers?

What credible sources explain this?

• Without a mode of operation you can only deterministically encrypt exactly 16 bytes. – CodesInChaos Mar 12 '15 at 10:32

Block ciphers map bit strings of fixed length to other bit strings of the same length. Hence, using only the block cipher primitive, you can't encrypt more than one block (typically 16 bytes), which is of course undesirable.

The straight-forward (but bad!) way around this limitation would be to split up the message into chunks of block length and individually encrypt those: this is exactly the description of electronic code book mode (ECB), which is easily seen to be broken under modern security requirements (specifically, it fails indistinguishability under a chosen-plaintext attack since equal plaintext blocks map to equal ciphertext blocks).

Hence, other constructions suggest themselves. A good block cipher mode should fulfill at least the following requirements:

• Each block must be encrypted in a different way. Since we want to reuse the same encryption function every time, the variation needs to be introduced somewhere else: For instance, cipher block chaining incorporates the preceding ciphertext block (which is pseudorandom if the cipher is secure) to mask each plaintext block, hence each $\mathit{block}$ is encrypted using the slightly modified cipher $\mathit{block}\mapsto F_k(\mathit{prev\_block}\oplus\mathit{block})$, thus satisfying the requirement.

Note that in CBC, the first block has no $\mathit{prev\_block}$, hence we need to substitute something else for it — this is what is known as an initialization vector (IV). One might be tempted to just use some fixed value, like $0$, but this is bad: The first block is not masked, hence an attacker can detect if two messages' prefixes are equal by comparing their corresponding ciphertexts' first blocks. This breaks indistinguishability under a chosen-plaintext attack (for multiple encryptions).

• Encryption must be nondeterministic due to the problem described in the previous paragraph. The easiest way to achieve this for CBC is to just plug in some random value for the IV and transmit it alongside the message. Just like the pseudorandom ciphertext blocks, the randomized IV masks the first plaintext block (and therefore all subsequent since each block depends on its predecessor), hence it hides equal messages and effectively avoids the problems that a fixed IV has.

(Note that while the example describes CBC, about the same arguments could be made for any other block cipher mode.)