Is there any reason to choose, say ECB over CBC? Or GCM over AEX? Or CTR over CFB? Is there a best AES mode of operation? And, when required, which is the best padding to use?
closed as too broad by kelalaka, AleksanderRas, Maarten Bodewes♦ Sep 15 at 19:51
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
There are 2 major types of mode of operation:
- The mode requires an initialization vector, which is subdivided into
1.1. a random IV. AES-CBC falls under this category, and
1.2. a unique nonce. AES-GCM and AES-CCM falls under this category.
For either of these subcategory, you should use a mode that provides authenticity guarantee (ideally choose an AEAD mode), so you should go with AES-GCM, or less preferably AES-CCM.
- The mode is a DAE (deterministic authenticated encryption), which many may not had encountered.
The AES-KW specified in NIST-SP-800-38-F is one such example, but it sometimes expands the ciphertext. I would recommend you look at AES-SIV in RFC5297.
For the other modes I've not mentioned, ECB simply eats your privacy for breakfast and you won't be able to implement XTS mode that interoperates with other mainstream systems.