# Mixing block cipher modes (AES)

I'm trying to evaluate some changes to an existing codebase and one question that has come up is the block cipher mode. For legacy reasons we've been using AES in CBC mode, however it's unclear why this decision was made. I'd like to propose moving to GCM, but I'm unsure if this will affect decrypting the data we already have stored.

In general I'm curious if the block mode actually affects the cipher text or if for a given key AES(X) = Y for all block modes.

In short, the answer is affects; Mode of operations are not interchangeable.

Mode of operations affect the ciphertext, they are not changeable without first decrypting with the old mode of operation and then encrypting with the new mode.

For example, consider ECB and CBC mode;

CBC mode uses $$IV \oplus P_1$$ as plaintext to encrypt the first block whereas in ECB only $$P_1$$ is used as plaintext. The other blocks encrypted as follows;

• $$C_i = Enc_k(P_i), 1\leq i \leq l$$, for ECB mode, and

• $$C_i = Enc_k(P_i \oplus C_{i-1}), 2\leq i \leq l$$ for the CBC mode.

As we can see, the plaintexts are different therefore the ciphertext are different.

Therefore; you have to first decrypt your data with the old mode of operation and then encrypt with the new mode.

note: if somehow there is an interchangeability, then any weakness/insecurity is carried to the other one, v.s.

You cannot decrypt any ciphertext encrypted by CBC using GCM. GCM mode uses CTR mode internally. CTR mode only uses the block cipher only in the encryption direction, while CBC mode relies on AES decrypt. Thus it is impossible to use GCM to decrypt ciphertext encrypted using CBC. You need to use CBC decrypt to retrieve the plaintext.

Instead you should use some kind of protocol version to detect with scheme was used. Then you can distinguish between the ciphertexts and use CBC or GCM where required. Of course you may want to convert the CBC ciphertext to GCM ciphertext anyway - by decrypting and then encrypting the data again, preferably using a different key for GCM encryption.

Introducing a protocol version field is kind of tricky if you've just got the CBC encrypted ciphertext as the ciphertext is indistinguishable from random. That said, the output of CBC mode encryption is always a multiple of the block size (unless ciphertext stealing is used), so you could introduce a version number and make sure that the version, IV and GCM ciphertext are not a multiple of the block size. If you can store the protocol version elsewhere then this should be preferred.

If possible you should try and use a container format such as CMS or PGP instead of trying to invent your own protocol. There are also more lightweight protocols such as Fernet.

• And for heaven't sake, please document your choices. – Maarten Bodewes Oct 24 '18 at 18:35