47
$\begingroup$

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ Please show some research effort in your questions.. and they can both be made just as secure if done right. They both have their pros and cons and target different uses. $\endgroup$
    – Thomas
    Jan 19, 2013 at 12:19
  • 3
    $\begingroup$ Ok because using CBC mode in SSH and using TLS 1.0 or below should not be used. Of course TLS 1.0 and below should not be used anyway. I am concerned in that I have seen no bugs on OpenSSL for CTR, but several for CBC. I'm wondering if AES-CTR is a better choice with TLSv1.1 and above. openssh.com/txt/cbc.adv kb.cert.org/vuls/id/958563 $\endgroup$
    – deb_infosec
    Sep 29, 2016 at 17:40
  • 1
    $\begingroup$ The Q does not specify communications at all much less SSH or SSL/TLS in particular. That SSH "vulnerability" hasn't been heard from again since 2008, and the OpenSSH folks, who are above-averagely aggressive on security, still have AES- and 3DES-CBC enabled (but not preferred) client-side in 7.3. There are no SSL/TLS ciphersuites with AES-CTR (or anything-CTR) as such, but in TLS1.2 (and 1.3 when it arrives) there are AEAD suites using AES-GCM and AES-CCM both of which are based on CTR. (Also Camellia-GCM, but I haven't seen that implemented.) $\endgroup$
    – dave_thompson_085
    Sep 30, 2016 at 11:22

2 Answers 2

Reset to default
43
$\begingroup$

I wrote a rather lengthy answer on another site a few days ago. Bottom-line is that CTR appears to be the "safest" choice, but that does not mean safe. The block cipher mode is only part of the overall protocol. Every mode has its quirks and requires some extra systems in order to use it properly; but in the case of CTR, the design of these extra systems is somewhat easier. For instance, when compared to OFB, there is no risk of a "short cycle" with CTR.

This is why actually usable modes like EAX and GCM internally use CTR.

Improve this answer
$\endgroup$
4
  • 11
    $\begingroup$ You should make it clearer that he should use EAX or GCM, or encrypt-then-HMAC. CTR or CBC by themselves can be very, very dangerous. $\endgroup$
    – Stephen Touset
    Jan 20, 2013 at 1:16
  • 5
    $\begingroup$ CTR mode is also easier to run in parallel on multiple cores, resulting in better performance. $\endgroup$
    – r3mainer
    Sep 29, 2016 at 21:55
  • $\begingroup$ Why do you intrigue us so much??? "actually usable models like EAX and GCM"... Thanks for providing linkes though! $\endgroup$
    – Paul-Sebastian Manole
    Jul 22, 2019 at 8:46
  • $\begingroup$ @squeamishossifrage, thanks for the quite important tip. Here's a validation reference from Wikipedia stating that CTR mode is well suited to operate on a multi-processor machine where blocks can be encrypted in parallel. If you can include it in your comment, I will delete this comment. $\endgroup$
    – Paul-Sebastian Manole
    Jul 22, 2019 at 8:49
1
$\begingroup$

In the context of the encryption of a mariadb database, according to the documentation.

choosing-an-encryption-algorithm

There are 2 modes of choice of encryption algorithm:

  1. The AES_CBC mode uses AES in Cipher Block Chaining (CBC) mode.
  2. The AES_CTR mode uses AES in two slightly different modes in different contexts. When encrypting table space pages (such as pages in InnoDB, XtraDB, and Aria tables), you use AES in Counter (CTR) mode. When encrypting temporary files (where ciphertext is allowed to be larger than plain text), use AES in Galois / Authenticated Counter (GCM) mode.

The recommended algorithm is AES_CTR, but this algorithm is only available when MariaDB is built with recent versions of OpenSSL. If the server is built with wolfSSL or yaSSL, then this algorithm is not available.

    MariaDB [(none)]> show global variables like "version_ssl_library";
    +---------------------+-----------------------------+
    | Variable_name       | Value                       |
    +---------------------+-----------------------------+
    | version_ssl_library | OpenSSL 1.1.1f  31 Mar 2020 |
    +---------------------+-----------------------------+

    MariaDB [mysql]> show global variables like "tls_version";
    +---------------+-------------------------+
    | Variable_name | Value                   |
    +---------------+-------------------------+
    | tls_version   | TLSv1.1,TLSv1.2,TLSv1.3 |
    +---------------+-------------------------+
Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.