8 Block Cipher Modes of Operation One of the drawbacks of the previous CPA-secure encryption scheme is that its ciphertexts are λ bits longer than its plaintexts. In the common case that we are using a block cipher with blocklength blen = λ, this means that ciphertexts are twice as long as plaintexts. Is there any way to encrypt data (especially lots of it) without requiring such a signicant overhead? A block cipher mode refers to a way to use a block cipher to eciently encrypt a large amount of data (more than a single block). In this chapter, we will see the most common modes for CPA-secure encryption of long plaintexts. 8.1 A Tour of Common Modes As usual, blen will denote the blocklength of a block cipher F. In our diagrams, we’ll write Fk as shorthand for F¹k; ·º. When m is the plaintext, we will write m = m1 km2 k · · · km`, where each mi is a single block (so ` is the length of the plaintext measured in blocks). For now, we will assume that m is an exact multiple of the block length. ECB: Electronic Codebook( never never use this! never‼) The most obvious way to use a block cipher to encrypt a long message is to just apply the block cipher independently to each block. The only reason to know about this mode is to know never to use it (and to publicly shame anyone who does). It can’t be said enough times: never use ECB mode! It does not provide security of encryption; can you see why? Construction 8.1 8 m1 m2 m3 ··· > (ECB Mode) > Enc¹k;m1 k · · · km`º: > ><> for i = 1 to `: Fk Fk Fk ··· ci := F¹k;mi º > > return c1 k · · · kc` > > c1 c2 c3 ··· : c c c ··· ¹ k · · · k º >8 1 2 3 Dec k;c1 c` : > > for i = 1 to `: > −1 >< −1 −1 −1 ··· mi := F ¹k;ci º Fk Fk Fk NEVERreturn m k · · · km > USE THIS! 1 ` > > > m1 m2 m3 ··· : © Copyright Mike Rosulek. Creative Commons BY-NC-SA 4.0. Latest version at joyofcryptography.com. Draft: January 3, 2021 CHAPTER 8. BLOCK CIPHER MODES OF OPERATION CBC: Cipher Block Chaining CBC (which stands for cipher block chaining) is the most common mode in practice. The CBC encryption of an `-block plaintext is ` + 1 blocks long. The rst ciphertext block is called an initialization vector (IV). Here we have described CBC mode as a randomized encryption, with the IV of each ciphertext being chosen uniformly. As you know, random- ization is necessary (but not sucient) for achieving CPA security, and indeed CBC mode provides CPA security. Construction 8.2 m m ··· 8 $ 1 2 (CBC Mode) > Enc¹k;m k · · · km º: > 1 ` > blen > ⊕ ⊕ c0 f0; 1g : > > for i = 1 to `: >< Fk Fk ··· ci := F¹k;mi ⊕ ci−1º > > return c0 kc1 k · · · kc` > > > > c c c ··· : 0 1 2 c0 c1 c2 ··· >8 > ¹ ; k · · · k º > Dec k c0 c` : > > for i = 1 to `: > F −1 F −1 ··· −1 >< k k mi := F ¹k;ci º ⊕ ci−1 return m k · · · km > 1 ` > ⊕ ⊕ > > > > m m ··· : 1 2 CTR: Counter The next most common mode in practice is counter mode (usually abbreviated as CTR mode). Just like CBC mode, it involves an additional IV block r that is chosen uniformly. The idea is to then use the sequence F¹k;rº; F¹k;r + 1º; F¹k;r + 2º; ··· as a long one-time pad to mask the plaintext. Since r is a block of bits, the addition ex- pressions like r + 1 refer to addition modulo 2blen (this is the typical behavior of unsigned addition in a processor). 145 Draft: January 3, 2021 CHAPTER 8. BLOCK CIPHER MODES OF OPERATION Construction 8.3 m1 m2 m3 ··· (CTR Mode) Enc¹k;m1 k · · · km`º: blen r f0; 1g $ +1 +1 +1 c0 := r for i = 1 to `: Fk Fk Fk ··· ci := F¹k;rº ⊕ mi blen r := r + 1 % 2 ⊕ ⊕ ⊕ return c0 k · · · kc` c0 c1 c2 c3 ··· OFB: Output Feedback OFB (output feedback) mode is rarely used in practice. We’ll include it in our discussion because it has the easiest security proof. As with CBC and CTR modes, OFB starts with a random IV r, and then uses the sequence: F¹k;rº; F¹k; F¹k;rºº; F¹k; F¹k; F¹k;rººº; ··· as a one-time pad to mask the plaintext. Construction 8.4 m1 m2 m3 ··· (OFB Mode) Enc¹k;m1 k · · · km`º: $ r f0; 1gblen c0 := r Fk Fk Fk ··· for i = 1 to `: r := F¹k;rº ci := r ⊕ mi ⊕ ⊕ ⊕ return c0 k · · · kc` c0 c1 c2 c3 ··· Compare & Contrast CBC and CTR modes are essentially the only two modes that are ever considered in prac- tice for CPA security. Both provide the same security guarantees, and so any comparison between the two must be based on factors outside of the CPA security denition. Here are a few properties that are often considered when choosing between these modes: I Although we have not shown the decryption algorithm for CTR mode, it does not even use the block cipher’s inverse F −1. This is similar to our PRF-based encryption scheme from the previous chapter (in fact, CTR mode collapses to that construction when restricted to 1-block plaintexts). Strictly speaking, this means CTR mode can be instantiated from a PRF; it doesn’t need a PRP. However, in practice it is rare to encounter an ecient PRF that is not a PRP. I CTR mode encryption can be parallelized. Once the IV has been chosen, the ith block of ciphertext can be computed without rst computing the previous i − 1 146 Draft: January 3, 2021 CHAPTER 8. BLOCK CIPHER MODES OF OPERATION blocks. CBC mode does not have this property, as it is inherently sequential. Both modes have a parallelizable decryption algorithm, though. I If calls to the block cipher are expensive, it might be desirable to pre-compute and store them before the plaintext is known. CTR mode allows this, since only the IV aects the input given to the block cipher. In CBC mode, the plaintext inuences the inputs to the block cipher, so these calls cannot be pre-computed before the plaintext is known. I It is relatively easy to modify CTR to support plaintexts that are not an exact multiple of the blocklength. (This is left as an exercise.) We will see a way to make CBC mode support such plaintexts as well, but it is far from trivial. I So far all of the comparisons have favored CTR mode, so here is one important property that favors CBC mode. It is common for implementers to misunderstand the security implications of the IV in these modes. Many careless implementations allow an IV to be reused. Technically speaking, reusing an IV (other than by acci- dent, as the birthday bound allows) means that the scheme was not implemented correctly. But rather than dumping the blame on the developer, it is good design practice to anticipate likely misuses of a system and, when possible, try to make them non-catastrophic. The eects of IV-reuse in CTR mode are quite devastating to message privacy (see the exercises). In CBC mode, reusing an IV can actually be safe, if the two plaintexts have dierent rst blocks! 8.2 CPA Security and Variable-Length Plaintexts Here’s a big surprise: none of these block cipher modes achieve CPA security, or at least CPA security as we have been dening it. Example Consider a block cipher with blen = λ, used in CBC mode. As you will see, there is nothing particularly specic to CBC mode, and the same observations apply to the other modes. In CBC mode, a plaintext consisting of ` blocks is encrypted into a ciphertext of ` + 1 blocks. In other words, the ciphertext leaks the number of blocks in the plaintext. We can leverage this observation into the following attack: A: c := eavesdrop¹0λ; 02λº ? return jcj = 2λ The distinguisher chooses a 1-block plaintext and a 2-block plaintext. If this distinguisher is linked to Lcpa-L, the 1-block plaintext is encrypted and the resulting ciphertext is 2 blocks (2λ bits) long. If the distinguisher is linked to Lcpa-R, the 2-block plaintext is encrypted and the resulting ciphertext is 3 blocks (3λ bits) long. By simply checking the length of the ciphertext, this distinguisher can tell the dierence and achieve advantage 1. 147 Draft: January 3, 2021 CHAPTER 8. BLOCK CIPHER MODES OF OPERATION So, technically speaking, these block cipher modes do not provide CPA security, since ciphertexts leak the length (measured in blocks) of the plaintext. But suppose we don’t re- ally care about hiding the length of plaintexts.1 Is there a way to make a security denition that says: ciphertexts hide everything about the plaintext, except their length? It is clear from the previous example that a distinguisher can successfully distinguish the CPA libraries if it makes a query eavesdrop¹mL;mR º with jmL j , jmR j. A simple way to change the CPA security denition is to just disallow this kind of query. The libraries will give an error message if jmL j , jmR j. This would allow the adversary to make the challenge plaintexts dier in any way of his/her choice, except in their length. It doesn’t really matter whether jmj refers to the length of the plaintext in bits or in blocks — whichever makes the most sense for a particular scheme.