0
$\begingroup$

Is there any reason to choose, say ECB over CBC? Or GCM over AEX? Or CTR over CFB? Is there a best AES mode of operation? And, when required, which is the best padding to use?

$\endgroup$

closed as too broad by kelalaka, AleksanderRas, Maarten Bodewes Sep 15 at 19:51

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ What do you want to encrypt? Data stream, disk or what? PS: You shouldn't never use ECB. $\endgroup$ – ventaquil Sep 15 at 12:34
  • 1
    $\begingroup$ It really depends on your scenario and if you have separate authentication (and the order of Encrypt and MAC). $\endgroup$ – tylo Sep 15 at 19:21
  • $\begingroup$ Data, @ventaquil. A python bytes like object to be specific. $\endgroup$ – Legorooj Sep 15 at 23:04
  • $\begingroup$ I generally use CTR then a HMAC, because CTR is malleable. $\endgroup$ – Legorooj Sep 15 at 23:05
1
$\begingroup$

There are 2 major types of mode of operation:

  1. The mode requires an initialization vector, which is subdivided into

1.1. a random IV. AES-CBC falls under this category, and

1.2. a unique nonce. AES-GCM and AES-CCM falls under this category.

For either of these subcategory, you should use a mode that provides authenticity guarantee (ideally choose an AEAD mode), so you should go with AES-GCM, or less preferably AES-CCM.

  1. The mode is a DAE (deterministic authenticated encryption), which many may not had encountered.

The AES-KW specified in NIST-SP-800-38-F is one such example, but it sometimes expands the ciphertext. I would recommend you look at AES-SIV in RFC5297.

For the other modes I've not mentioned, ECB simply eats your privacy for breakfast and you won't be able to implement XTS mode that interoperates with other mainstream systems.

$\endgroup$
  • $\begingroup$ Thanks, this helps. $\endgroup$ – Legorooj Sep 15 at 22:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.