Block Cipher Modes of Operation: ECB, CBC, CTR, and GCM

A block cipher like AES only encrypts one fixed-size block at a time (16 bytes for AES). Block cipher modes of operation define how to repeatedly apply the cipher to encrypt messages of any length safely. The mode you choose is as important as the cipher itself: a strong cipher used in a weak mode can leak data or allow tampering. This article explains the four most important modes, ECB, CBC, CTR, and GCM, and when each is appropriate.

Why Modes Matter

Encrypting a long message means processing many blocks. How those blocks relate to one another determines whether patterns leak, whether identical messages look identical, and whether an attacker can alter ciphertext undetected. Modes address several concerns:

• Confidentiality: hiding the plaintext, including structural patterns.
• Randomization: ensuring the same plaintext encrypts differently each time, using an initialization vector (IV) or nonce.
• Integrity: detecting tampering, which only authenticated modes provide.

A recurring theme is that confidentiality alone is not enough. Modern best practice is authenticated encryption, which combines secrecy with integrity.

ECB: Electronic Codebook (Avoid)

ECB is the simplest mode: each block is encrypted independently with the same key. Its fatal flaw is determinism. Because identical plaintext blocks always produce identical ciphertext blocks, ECB leaks structure.

The classic illustration is encrypting a bitmap image: with ECB, the outline of the image remains clearly visible in the ciphertext because repeating pixel blocks map to repeating ciphertext. ECB provides no diffusion between blocks and no randomization.

• Verdict: Do not use ECB for encrypting data. It is retained mostly as a teaching example of what not to do.

CBC: Cipher Block Chaining

CBC chains blocks together so that each ciphertext block depends on all previous ones. Before encryption, each plaintext block is XORed with the previous ciphertext block; the first block is XORed with a random initialization vector (IV).

C[0] = Encrypt(P[0] XOR IV)
C[i] = Encrypt(P[i] XOR C[i-1])   for i > 0

Key properties and pitfalls of CBC:

• The IV must be random and unpredictable for each message; a predictable IV enabled the historical BEAST attack on TLS.
• CBC requires padding (such as PKCS#7) because the plaintext must be a multiple of the block size. Padding introduced the infamous padding oracle attack, where error responses reveal whether padding is valid, letting an attacker decrypt data.
• CBC provides no integrity on its own. It must be combined with a MAC like HMAC, using encrypt-then-MAC ordering.
• Encryption is sequential, though decryption can be parallelized.

CBC is still widely deployed but is error-prone, and authenticated modes are preferred for new designs.

CTR: Counter Mode

CTR turns a block cipher into a stream cipher. Instead of encrypting the plaintext directly, it encrypts a sequence of counter values to produce a keystream, which is then XORed with the plaintext. Concretely, each keystream block is the cipher applied to the nonce combined with an incrementing counter value, and that keystream block is XORed with the corresponding plaintext block to yield the ciphertext.

Advantages of CTR:

• Parallelizable for both encryption and decryption, since counter blocks are independent.
• No padding required, because it operates as a stream.
• Random access to any part of the ciphertext.

The critical rule is that each (key, nonce/counter) pair must never repeat. Reusing a counter value with the same key reuses keystream, which is catastrophic. Like CBC, plain CTR provides confidentiality but no integrity, so it must be paired with a MAC. CTR is the foundation of the authenticated GCM mode.

GCM: Galois/Counter Mode

GCM is the most important mode for modern systems because it provides authenticated encryption with associated data (AEAD). It combines CTR-mode encryption for confidentiality with a fast, parallelizable authentication function called GHASH, which operates in the Galois field GF(2^128) to produce an authentication tag (typically 128 bits).

GCM delivers:

• Confidentiality via CTR-mode keystream.
• Integrity and authenticity via the GHASH tag over both the ciphertext and any associated data (headers or metadata that stay in the clear but must be authenticated).
• High performance, especially with hardware support for AES and carry-less multiplication.

AES-GCM is the default cipher suite in much of TLS and many protocols. Its one sharp edge is nonce management: reusing a nonce with the same key in GCM is especially dangerous, because it not only breaks confidentiality but can also leak the authentication key, enabling forgeries. Nonces are commonly 96 bits and must be unique per key. Where nonce uniqueness is hard to guarantee, nonce-misuse-resistant modes like AES-GCM-SIV offer a safety margin.

Choosing a Mode

A practical decision guide:

1. Prefer an AEAD mode. Use AES-GCM or ChaCha20-Poly1305 for almost all new applications. They handle confidentiality and integrity together.
2. Never use ECB for confidentiality.
3. If you must use CBC or CTR, always add a strong MAC (encrypt-then-MAC) and manage IVs/nonces carefully.
4. Manage nonces rigorously. Ensure uniqueness per key, and consider misuse-resistant variants when uniqueness cannot be guaranteed.
5. Do not roll your own combination of primitives when a vetted AEAD mode is available.

Key Takeaways

• Block cipher modes extend a block cipher like AES to encrypt arbitrary-length data, and the choice of mode is as critical as the cipher.
• ECB is insecure because it encrypts identical blocks identically and leaks structure; never use it.
• CBC and CTR provide confidentiality but no integrity, and both require careful IV/nonce handling plus a separate MAC.
• GCM provides authenticated encryption (AEAD), combining CTR-mode confidentiality with GHASH integrity, and AES-GCM is the modern default.
• Never reuse a nonce with the same key, especially in GCM; prefer vetted AEAD modes and misuse-resistant variants over custom constructions.