CBC and CTR: chaining or counting

The flaw in ECB stems from the fact that each block is encrypted independently. Good modes break this independence.

CBC: chaining blocks

In CBC (Cipher Block Chaining) mode, each block of plaintext is XORed with the previous ciphertext before being encrypted:

   IV        C1        C2
    |         |         |
P1->(+)   P2->(+)   P3->(+)
    |         |         |
  [E_K]     [E_K]     [E_K]
    |         |         |
   C1        C2        C3

The first block has no predecessor: it is supplied with an initialisation vector (IV), randomly generated for each message.

Consequence: two identical blocks no longer produce the same ciphertext, as they are mixed with different values. And encrypting the same message twice with the same IV would yield the same result — hence the rule: a new, unpredictable IV for each message.

CTR: transforming the block into a stream

The CTR (Counter) mode takes a different approach. It does not encrypt the message: it encrypts a counter, and uses the result as a mask to be combined with the plaintext.

 N||1      N||2      N||3
   |         |         |
 [E_K]     [E_K]     [E_K]
   |         |         |
P1->(+)   P2->(+)   P3->(+)
   |         |         |
  C1        C2        C3

N is a nonce (a number used only once) concatenated to the block number.

This has two advantages: blocks are calculated in parallel and in any order, and the message no longer needs to be padded to a multiple of 16 bytes.

The pitfall of CTR

Reusing the same pair (key, nonce) on two messages is disastrous. Both are masked by the same S sequence, and so:

C1 (+) C2 = (P1 (+) S) (+) (P2 (+) S) = P1 (+) P2

The mask disappears, and all that remains is the XOR of the two plaintexts — which can be analysed. This is precisely the vulnerability of a reused one-time pad.

What about authenticity?

CBC and CTR ensure confidentiality, not integrity: an attacker can modify the ciphertext without being detected. In practice, therefore, an authenticated mode such as AES-GCM is used, which adds a verified authentication tag to the decrypted data.