# AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?

• Please show some research effort in your questions.. and they can both be made just as secure if done right. They both have their pros and cons and target different uses. – Thomas Jan 19 '13 at 12:19
• Ok because using CBC mode in SSH and using TLS 1.0 or below should not be used. Of course TLS 1.0 and below should not be used anyway. I am concerned in that I have seen no bugs on OpenSSL for CTR, but several for CBC. I'm wondering if AES-CTR is a better choice with TLSv1.1 and above. openssh.com/txt/cbc.adv kb.cert.org/vuls/id/958563 – deb_infosec Sep 29 '16 at 17:40
• The Q does not specify communications at all much less SSH or SSL/TLS in particular. That SSH "vulnerability" hasn't been heard from again since 2008, and the OpenSSH folks, who are above-averagely aggressive on security, still have AES- and 3DES-CBC enabled (but not preferred) client-side in 7.3. There are no SSL/TLS ciphersuites with AES-CTR (or anything-CTR) as such, but in TLS1.2 (and 1.3 when it arrives) there are AEAD suites using AES-GCM and AES-CCM both of which are based on CTR. (Also Camellia-GCM, but I haven't seen that implemented.) – dave_thompson_085 Sep 30 '16 at 11:22

## 2 Answers

I wrote a rather lengthy answer on another site a few days ago. Bottom-line is that CTR appears to be the "safest" choice, but that does not mean safe. The block cipher mode is only part of the overall protocol. Every mode has its quirks and requires some extra systems in order to use it properly; but in the case of CTR, the design of these extra systems is somewhat easier. For instance, when compared to OFB, there is no risk of a "short cycle" with CTR.

This is why actually usable modes like EAX and GCM internally use CTR.

• You should make it clearer that he should use EAX or GCM, or encrypt-then-HMAC. CTR or CBC by themselves can be very, very dangerous. – Stephen Touset Jan 20 '13 at 1:16
• CTR mode is also easier to run in parallel on multiple cores, resulting in better performance. – r3mainer Sep 29 '16 at 21:55
• Why do you intrigue us so much??? "actually usable models like EAX and GCM"... Thanks for providing linkes though! – Paul-Sebastian Manole Jul 22 '19 at 8:46
• @squeamishossifrage, thanks for the quite important tip. Here's a validation reference from Wikipedia stating that CTR mode is well suited to operate on a multi-processor machine where blocks can be encrypted in parallel. If you can include it in your comment, I will delete this comment. – Paul-Sebastian Manole Jul 22 '19 at 8:49

### In the context of the encryption of a mariadb database, according to the documentation.

choosing-an-encryption-algorithm

There are 2 modes of choice of encryption algorithm:

1. The AES_CBC mode uses AES in Cipher Block Chaining (CBC) mode.
2. The AES_CTR mode uses AES in two slightly different modes in different contexts. When encrypting table space pages (such as pages in InnoDB, XtraDB, and Aria tables), you use AES in Counter (CTR) mode. When encrypting temporary files (where ciphertext is allowed to be larger than plain text), use AES in Galois / Authenticated Counter (GCM) mode.

The recommended algorithm is AES_CTR, but this algorithm is only available when MariaDB is built with recent versions of OpenSSL. If the server is built with wolfSSL or yaSSL, then this algorithm is not available.

    MariaDB [(none)]> show global variables like "version_ssl_library";
+---------------------+-----------------------------+
| Variable_name       | Value                       |
+---------------------+-----------------------------+
| version_ssl_library | OpenSSL 1.1.1f  31 Mar 2020 |
+---------------------+-----------------------------+

    MariaDB [mysql]> show global variables like "tls_version";
+---------------+-------------------------+
| Variable_name | Value                   |
+---------------+-------------------------+
| tls_version   | TLSv1.1,TLSv1.2,TLSv1.3 |
+---------------+-------------------------+