Block Cipher Modes of Operation
A primitive block cipher permutes only a single fixed-size block (16 bytes for AES/SEED/ARIA/Camellia/SM4, 8 bytes for DES/TDES). To securely encrypt arbitrary-length messages, a mode of operation defines how blocks are chained, turned into a keystream, or combined with authentication tags. Symmetric cipher nodes in NodeCrypto expose a Cipher Mode parameter and dynamically show only the input/output ports required by the selected mode.
| Mode | Category | Standard | Additional Ports |
|---|---|---|---|
| ECB | Independent Block | NIST SP 800-38A §6.1 | — |
| CBC | Block Chaining | NIST SP 800-38A §6.2 | IV |
| GCM | AEAD | NIST SP 800-38D | Nonce, AAD (optional), Auth Tag |
| CCM | AEAD | NIST SP 800-38C | Nonce, AAD (optional), Auth Tag |
| CTR | Stream (Counter) | NIST SP 800-38A §6.5 | IV |
| CFB | Stream (Feedback) | NIST SP 800-38A §6.3 | IV |
| OFB | Stream (Feedback) | NIST SP 800-38A §6.4 | IV |
| XTS | Disk / Sector Encryption | IEEE 1619-2007 / NIST SP 800-38E | IV (Tweak) |
| KW | Key Wrapping | NIST SP 800-38F / RFC 3394 | — |
Deterministic Default IV / Nonce: If an optional IV or Nonce port is left unconnected, NodeCrypto does not generate a random value; instead, it deterministically supplies an all-zero byte array of the required length (16 bytes for CBC/CTR/CFB/OFB/XTS on 128-bit block ciphers, 8 bytes on DES/TDES, and 12 bytes for GCM/CCM). This guarantees reproducible execution for test vectors and protocol debugging, but in production protocols you must always supply a unique nonce or unpredictable IV.
ECB (Electronic Codebook)
Encrypts each plaintext block independently under the same key. No chaining state, initialization vector, or counter is carried between blocks. Requires the input length to be a multiple of the block size (or a Padding mode other than None).
CBC (Cipher Block Chaining)
XORs each plaintext block with the preceding ciphertext block (or with the Initialization Vector IV for the first block) before applying the block cipher encryption function. Because each block depends on all prior blocks, identical plaintext blocks encrypt to different ciphertext blocks. Requires block alignment or a reversible Padding scheme such as PKCS7.
IV must be unpredictable (random) for every message encrypted under the same key, and CBC alone does not protect against ciphertext tampering (padding oracle attacks). Prefer an AEAD mode (GCM) or pair CBC with an Encrypt-then-MAC (HMAC) construction.GCM (Galois/Counter Mode)
An Authenticated Encryption with Associated Data (AEAD) mode that combines Counter (CTR) mode encryption with a universal hash function (GHASH) over GF(2128). Provides both confidentiality and integrity in a single operation. No block padding is needed; ciphertext length equals plaintext length, and a separate 16-byte Auth Tag is produced. During decryption, if the supplied Auth Tag does not match the computed tag over AAD and Ciphertext, the node fails immediately with AUTH_TAG_MISMATCH and emits no plaintext.
Nonce with the same key in GCM mode. A single nonce collision leaks the XOR of plaintexts and allows an attacker to recover the GHASH authentication key and forge arbitrary tags.CCM (Counter with CBC-MAC)
An AEAD mode designed for 128-bit block ciphers (AES, SEED, ARIA) that combines CTR mode encryption with a CBC-MAC authentication tag. Like GCM, it authenticates both the encrypted payload and optional cleartext AAD without requiring block padding, and fails with AUTH_TAG_MISMATCH if verification fails during decryption.
CTR (Counter Mode)
Turns a block cipher into a synchronous stream cipher by encrypting successive values of a 16-byte counter block (initialized from IV) and XORing the resulting keystream with the plaintext. Does not require block padding, allows arbitrary input lengths, and uses the block cipher's encryption function for both encryption and decryption.
IV) with the same key reuses the keystream, immediately exposing the XOR of the plaintexts. CTR provides no integrity protection on its own (bit-flipping the ciphertext flips the exact same bit in the decrypted plaintext).CFB (Cipher Feedback)
A self-synchronizing stream cipher mode that encrypts the previous ciphertext block (starting with IV) using the block cipher and XORs the output with the current plaintext block to produce the next ciphertext block. Does not require block padding.
OFB (Output Feedback)
A synchronous stream cipher mode that repeatedly encrypts the block cipher's own output (starting from IV) to generate a keystream independent of the plaintext and ciphertext, then XORs that keystream with the data. Encryption and decryption are identical operations, and no block padding is required.
XTS (XEX-based Tweaked-Codebook Mode with Ciphertext Stealing)
Specialized mode for encrypting fixed-size storage sectors (such as full-disk encryption). Splits a double-length key into two independent AES keys (K1 || K2): K2 encrypts the 16-byte tweak (supplied via IV), while K1 encrypts the data blocks combined with finite-field powers of the encrypted tweak. Handles non-block-aligned trailing bytes via ciphertext stealing, so no padding is added, but the input must be at least 16 bytes long (otherwise fails with DATA_TOO_SHORT).
KW (AES Key Wrap)
Deterministic key-wrapping mode designed to protect cryptographic keys at rest or in transit using another AES Key Encryption Key (KEK). Plaintext key material must be a multiple of 8 bytes (64-bit semiblocks) and at least 16 bytes long. Encrypting appends an 8-byte integrity header (ciphertext is 8 bytes longer than plaintext); decrypting unwraps and verifies the 64-bit integrity check value, failing with AUTH_TAG_MISMATCH if the wrapped key was modified or the wrong KEK was used.