Hi everyone. @lemony-cricket here. Let's learn about block ciphers and modes of operation! We're nearing the end of our introduction to encryption, but don't be sad! I'm really excited to get into digital signatures and hashes and everything else cryptography has to offer!

<hr />

<center><img src="https://lemony.cricket/wp-content/uploads/2018/07/cryptography101.png" />
<sup>Rocket graphic extracted from <a href="https://pixabay.com/en/planet-rocket-space-stars-1297860">this CC0 image</a> from <a href="https://pixabay.com/en/users/OpenClipart-Vectors-30363/">OpenClipart-Vectors on Pixabay</a>.</sup></center>

<hr />

<h1>Retrospective</h1>
<strong>It's been almost a month since the <a href="https://steemit.com/steemstem/@lemony-cricket/introductiontocryptographyiencryptionsalsa20streamcipher-62e89vfmol">last installment of Introduction to Cryptography</a>.</strong> Unfortunately, nobody actually completed the activity last time, which gives us not a lot to talk about in this retrospective section! An honourable mention goes to @procrastilearner, who contributed <a href="https://steemit.com/steemstem/@procrastilearner/re-lemony-cricket-introductiontocryptographyiencryptionsalsa20streamcipher-62e89vfmol-20180621t013505634z">a good question to which I thoroughly enjoyed responding.</a>

<strong>Last time we learned about stream ciphers. </strong>That was our first introduction to the marvelous world of modern encryption. That stuff is actually in our web servers and browsers making 'em tick! Neat, eh?

<strong>Stream ciphers are simple and convenient.</strong> They tend to have extremely fast hardware implementations. They don't require padding (we'll define that later). They have one mode of operation; they generate a keystream, which is then used as if it were a <a href="https://steemit.com/steemstem/@lemony-cricket/introductiontocryptographyiencryptionpt2one-timepadsandstreamcipherintro-no463jdqw7">one-time pad</a>. For better or for worse, that's all they can do.
<h1>Block ciphers and their modes of operation</h1><sup>the most versatile form of symmetic-key encryption</sup>

<strong>Block cipher</strong><strong>s, on the other hand,</strong> are a bit more powerful, but a bit more complicated as well. For example, in most modes, block ciphers operate directly upon the plaintext rather than generating a keystream. They also require proper <em><strong>padding</strong></em><sup><sup>d1</sup></sup> at the end of the plaintext unless it exactly matches up with the block size.

<strong>It's also not enough to know which <em>cipher </em>you're using;</strong> you also need to choose a <em><strong>mode of</strong> <strong>operation</strong></em><sup><sup>d2</sup></sup>. These modes of operation are public and widely standardised and work with <em>any</em> block cipher available. Let's take a look at some of these modes.
<h2>Electronic codebook (ECB)</h2>

<hr />

<center><img src="https://lemony.cricket/wp-content/uploads/2018/07/ecb.png" />
<sup>By WhiteTimberwolf on <a href="https://commons.wikimedia.org/w/index.php?curid=26434116">Wikimedia Commons</a>. Public domain.</sup></center>

<hr />

<strong>The diagram above </strong>illustrates the <strong>electronic codebook</strong>, or <strong>ECB</strong>, mode of operation. It's called "electronic codebook" because it is actually a really large substitution cipher, like the <a href="https://steemit.com/steemstem/@lemony-cricket/introduction-to-cryptography-i-encryption-pt-1-the-caesar-cipher">Caesar shift</a>. The differences are that it's more of a "scramble" than a "shift," and it has a much, <em>much</em> larger alphabet, with each possible <em><strong>permutation</strong></em><sup><sup>d3</sup></sup> of the block size representing a different "letter."

<strong>In this most basic mode of operation,</strong> the same key is used to encrypt every block of plaintext. That means that if any of the blocks are exactly the same, those blocks in the ciphertext will <em>also</em> be exactly the same. Now, if you're starting to get a bad vibe about this, <em>good</em>. You're learning!

<strong>It's true that ECB has some severe flaws,</strong> and for this reason, it is almost <em>never</em> used except as an example of how block ciphers work, since it's really the most bare-bones mode available. You might already have an idea about what the flaws are, but we'll save that discussion for later.
<h2>Cipher block chaining (CBC)</h2>

<hr />

<center><img src="https://lemony.cricket/wp-content/uploads/2018/07/cbc.png" />
<sup>By WhiteTimberwolf on <a href="https://commons.wikimedia.org/w/index.php?curid=26434096">Wikimedia Commons</a>. Public domain.</sup></center>

<hr />

<strong>No, not "blockchaining." </strong>Actually, there is a slight similarity here! Blockchains are so-called because each new <em>block</em> includes a mathematically indisputable link to the previous block. Similarly, while encrypting in CBC mode, we <strong>combine</strong> the ciphertext from the <em>previous</em> block with the <em>plaintext</em> of the current block before the encryption operation, using a bitwise exclusive-or (XOR) operation.

<strong>CBC thereby solves the problem with ECB</strong> since each block depends not only on the key, but also on the previous ciphertext. This effectively breaks the ability to observe patterns in the ciphertext and serves to increase a desirable property we call <strong><em>diffusion</em></strong><sup><sup>d4</sup></sup>.

<strong>But what's that "<em>initialisation vector</em><sup><sup>d5</sup></sup>" all about?</strong> Well, since there <em>is</em> no previous ciphertext to combine with the plaintext for the first block, a random value must be used instead. The <em>random</em> part is actually pretty important; the IV doesn't have to stay <em>secret</em>, but it cannot be <em>predictable</em> or else it opens the door for certain attacks.

<strong>An interesting quirk of CBC </strong>is that even though the IV doesn't <em>have</em> <em>to </em>stay secret, it's actually not even necessary to tell the decrypting party what it is. All you have to do is pad the first block with arbitrary, disposable data before you encrypt it... then just <em>throw it away</em> on the other side. This works because the subsequent blocks rely only upon the <em>ciphertext</em>, not the <em>plaintext</em>. So, decrypting with the wrong IV will result in the first block being mangled, but every block after it will be fine! This trick is actually widely accepted and used in at least one prominent encryption standard, <a href="http://www.ietf.org/rfc/rfc4346.txt">TLS 1.1</a>, where it was deployed to fix a prior vulnerability.
<h2>Counter (CTR)</h2>

<hr />

<center><img src="https://lemony.cricket/wp-content/uploads/2018/07/ctr.png" />
<sup>By WhiteTimberwolf on <a href="https://commons.wikimedia.org/w/index.php?curid=26434109">Wikimedia Commons</a>. Public domain.</sup></center>

<hr />

<strong>The counter mode takes a different</strong> <strong>approach</strong>. Instead of taking the <em>plaintext</em> as input like the other modes we've seen so far, it splits the input between a nonce and a counter. The counter is incremented with each block number, but the nonce stays the same for the entire session and should never be used again with the same key. Once the output is generated, it's combined with the plaintext with a XOR operation...

<strong>Hey! Haven't we seen this before?!</strong> Yes! One of the coolest things about cryptography is that since most of the algorithms are built around similar principles and have similar properties, they can often be safely used to construct substitutes for one another. An algorithm built for use as a stream cipher is often perfectly suitable for use as a <strong><em>CSPRNG</em></strong><sup><sup>d6</sup></sup>. As @procrastilearner found out in <a href="https://steemit.com/steemstem/@lemony-cricket/re-procrastilearner-re-lemony-cricket-introductiontocryptographyiencryptionsalsa20streamcipher-62e89vfmol-20180621t021358213z">my reply to his question</a>, we can even use a hashing algorithm to generate a secure (if rather slow) stream cipher. It's not unheard of for certain implementations to re-use existing <em><strong>primitives</strong></em><sup><sup>d7</sup></sup> in these sorts of ways, especially in <em><strong>embedded</strong> <strong>systems</strong></em><sup><sup>d8</sup></sup> where there may be extremely restrictive space and/or memory constraints.

<strong>Counter mode</strong> <strong>is a way to turn a block cipher into a stream cipher</strong><strong>. </strong>There are other modes like this too, like cipher feedback (CFB) and output feedback (OFB), and others which do more advanced things, but I think we've reached a sufficiently advanced point and this is an <em>introduction</em> to cryptography series, after all.
<h1>Interactive exercise</h1>
<strong>Below are two images; </strong>the one on the right is an encrypted version of the one on the left.

<hr />

<center><img src="https://lemony.cricket/wp-content/uploads/2018/07/lemony-ecb-1.png" />
<sup>My continuous undying thanks to @saywha, who made this monster for me!</sup></center>

<hr />

<strong>Woah! That doesn't seem right.</strong> Take your best guess at what went wrong here and explain how you came to that conclusion. <strong>100% upvotes await all thoughful answers!</strong>

<h1>Definitions</h1><sup>From my personal knowledge and experience unless otherwise noted.</sup>

<ol>
 	<li><strong>padding</strong>: extra data which must be used to "fill up" the last block when using a mode of operation which operates directly upon blocks of plaintext.</li>
 	<li><strong>mode of operation</strong>: the combination of inputs, outputs, and intermediate steps used with a block cipher to allow it to operate on data sets larger than the block size.</li>
 	<li><strong>permutation</strong>: a distinct arrangement of a set of items. For example, the following sequence contains all permutations of the first three positive integers: [123, 132, 213, 231, 312, 321]</li>
 	<li><strong>diffusion</strong>: a desirable property of cryptography which states that any single change to the plaintext should affect all bits of the ciphertext with equal probability. ECB has poor diffusion because changes to the plaintext affect only the current block.</li>
 	<li><strong>initialisation vector</strong>: a nonce, specifically one used as (or which modifies) the input to the initial block.</li>
 	<li><strong>CSPRNG</strong>: In cryptography, there is often a need to generate "random-looking" numbers in a deterministic (and therefore reproducible) fashion. An algorithm used for this purpose is called a CSPRNG: cryptographically secure pseudorandom number generator.</li>
 	<li><strong>primitives</strong>: <em>"well-established, low-level cryptographic algorithms that are frequently used to build cryptographic protocols for computer security systems. These routines include, but are not limited to, one-way hash functions and encryption functions." </em><sup><a href="https://en.wikipedia.org/wiki/Cryptographic_primitive">source</a></sup></li>
 	<li><strong>embedded systems</strong>: computer systems which exist as part of an appliance or other purpose-built hardware. The computer inside your car is an embedded system, for instance, and so is the one inside your microwave.</li>
</ol>

<h1>References</h1>
<ul>
 	<li>https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation</li>
 	<li>http://netlab.cs.ucla.edu/wiki/files/shannon1949.pdf</li>
 	<li>https://github.com/dancodery/electronic-codebook-image-demonstration</li>
 	<li>https://en.wikipedia.org/wiki/Cryptographic_primitive</li>
</ul>

<h1>Additional thoughts</h1>

<strong>If you enjoy my work, please leave a comment. </strong>Even if you don't feel like doing the activity (which I may stop doing soon or at least not every time), don't hesitate to add something else to the discussion. Is there something I could have explained better? Got a question you think is dumb? Ask it! <em>(It isn't. This stuff is hard.) </em>

<strong>You'll get an upvote from me,</strong> my undying appreciation, and y'know... <em>someday</em> when I am rich and famous, I'll remember you as I shoo away the onslaught of <a href="https://www.wordnik.com/words/sycophant">elephants</a>. 🍋
<br /><center><hr/>

<em>Posted from my blog with <a href='https://wordpress.org/plugins/steempress/'>SteemPress</a> : https://lemony.cricket/2018/07/16/introduction-to-cryptography-i-encryption-pt-4-block-ciphers-modes-of-operation/</em><hr/></center>