# How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for video over internet: > 1200 B payload)

1. Is it really just a block cipher in ECB mode, so that each packet can be decoded without any prior packet⁰?
2. Is it a block cipher in some non-ECB mode, but it gets reset at the start of a packet?
3. Is it a block cipher in some non-ECB mode, but we're just using a sufficiently large number of say $$N$$ different keys, de- and encoder, which we use in interleaved / sequential fashion, so that any erasure of less than $$N$$ successive packets gives us enough time to let the transmitter know we need to re-initialize the receiver?¹
4. Would you go the WiFi/WPA route of deriving a key for each packet, leading to the couple of attacks we know against that TKIP/KDF method?
5. Am I totally missing everything?

I've tried to look into how KASUMI (3G crypto standard) does this, but I haven't been able to track down the relevant standards document.

⁰ ... and everyone is bashing Zoom for adhering to industry best practice?

¹ wouldn't that lead to feasibility of forcing the encoder to a known state by an attacker with control over which packets get lost?

• I'm assuming that the receiver will know which packets are missing? (plain sequence numbers or something) If that's the case, CTR mode or any other stream cipher would work without any problems by just skipping part of the keystream. – Maeher Apr 4 at 11:23
• Format the header and the data payload properly and apply a well-designed AEAD cipher is the best current practice that some people fail to do. – DannyNiu Apr 4 at 11:23
• @Maeher yep, a sequence number can be assumed to be present; had to look up CTR mode, ah, yeah, that makes a lot of sense. – Marcus Müller Apr 4 at 11:27
• @DannyNiu um, picture me confused: I'm asking "what (or how) is a well-designed cipher mode for this scheme?" and you answer by "just use a well-designed cipher!"; am I missing something? – Marcus Müller Apr 4 at 11:28
• @MarcusMüller It's not just any well-designed cipher. A properly designed AEAD cipher protects the confidentiality of the data payload as well as the authenticity of the data and the header. In this way, AEAD provides an "interface" to the application to detect a wide range of passive and active attacks. – DannyNiu Apr 4 at 11:30