Symmetric Encryption · Modes of Operation

Four ways the same block cipher encrypts a message

A block cipher only encrypts a single fixed-size block. To encrypt a longer message, the cipher is applied repeatedly under a chosen mode. Each mode chains blocks together differently, and those choices change parallelism, error propagation, and security guarantees. Here are the four classical modes operating on the same plaintext side by side.

Interactive lecture aidRolling Thunder Security · Cybersecurity Fundamentals
Stage 0 / 4
ECB Electronic Code Book

The simplest mode. Each plaintext block is encrypted on its own with the same key. Identical plaintext blocks always produce identical ciphertext blocks, which leaks structure and is ECB's well-known weakness.

Block 1 Block 2 Block 3 P₁ key K ENCRYPT block cipher C₁ P₂ key K ENCRYPT block cipher C₂ P₃ key K ENCRYPT block cipher C₃ Cᵢ = E(K, Pᵢ) · blocks fully independent · parallelizable
CBC Cipher Block Chaining

Each plaintext block is XORed with the previous ciphertext block before encryption. The first block uses an initialization vector (IV). Identical plaintext blocks now produce different ciphertext, but encryption cannot be parallelized.

Block 1 Block 2 Block 3 IV P₁ ⊕ key K ENCRYPT block cipher C₁ P₂ ⊕ key K ENCRYPT block cipher C₂ C₁ feedback C₂ feedback P₃ ⊕ key K ENCRYPT block cipher C₃ C₁ = E(K, P₁ ⊕ IV) · Cᵢ = E(K, Pᵢ ⊕ Cᵢ₋₁) · sequential, IV must be unpredictable
CFB Cipher Feedback

The cipher encrypts the previous ciphertext (or IV) and the result is XORed with plaintext to produce the next ciphertext. The block cipher itself is only ever used to encrypt, so CFB turns a block cipher into a self-synchronizing stream cipher.

Block 1 Block 2 Block 3 IV key K ENCRYPT block cipher ⊕ P₁ C₁ C₁ feeds next encryption key K ENCRYPT block cipher ⊕ P₂ C₂ C₂ feeds next encryption key K ENCRYPT block cipher ⊕ P₃ C₃ C₁ = P₁ ⊕ E(K, IV) · Cᵢ = Pᵢ ⊕ E(K, Cᵢ₋₁) · decryption uses ENCRYPT, never DECRYPT
OFB Output Feedback

The cipher encrypts its own previous output, generating a keystream Oᵢ that is XORed with plaintext. Unlike CFB, the keystream depends only on the key and IV, so a bit flip in ciphertext flips one bit of plaintext on decryption and never propagates.

Block 1 Block 2 Block 3 IV key K ENCRYPT block cipher O₁ ⊕ P₁ C₁ O₁ becomes next input key K ENCRYPT block cipher O₂ ⊕ P₂ C₂ O₂ becomes next input key K ENCRYPT block cipher O₃ ⊕ P₃ C₃ O₁ = E(K, IV) · Oᵢ = E(K, Oᵢ₋₁) · Cᵢ = Pᵢ ⊕ Oᵢ · keystream is plaintext-independent

Color Reference

Pᵢ — plaintext blocksame input across all four modes
Cᵢ — ciphertext blockfinal encrypted output
IV — initialization vectorrandom per-message starting value
E(K, ·) — block ciphersame key K used in every block
⊕ — XORbitwise, its own inverse
Oᵢ — OFB keystreamindependent of plaintext

Press Space to play or pause · R to reset · → to step