Block ciphers · Modes of operation · KL 3.6
The picture below is 192 × 240 pixels of raw RGB, which is 8,640 AES blocks. Each panel encrypts those same bytes with the same AES-128 key; only the mode differs. Press Encrypt and watch which one still shows the letter.
C[i] = Enck(M[i])
Deterministic, block by block. Equal plaintext blocks give equal ciphertext blocks, so every flat region of the picture becomes a flat repeating texture and the outline survives. Encrypting again gives the same bytes.
C[i] = Enck(C[i−1] ⊕ M[i]), C[0] = IV
Chaining makes every block's input depend on everything before it, so repeats vanish. Sequential to encrypt.
O[i] = Enck(O[i−1]), C[i] = M[i] ⊕ O[i]
A stream cipher: the key stream never looks at the message and can be computed ahead of time.
C[i] = M[i] ⊕ Enck(ctr + i)
Also a stream cipher, but every block is independent, so it parallelizes. CPA-secure if the cipher is a PRF.
Try Reuse the same IV / nonce, then Encrypt again: CBC, OFB and CTR become
deterministic, just like ECB. For OFB and CTR it is worse. The same key stream is XORed into both
encryptions, so C ⊕ C′ = M ⊕ M′.
AES-128 is implemented from FIPS-197 in this page and checked against the standard's test vector when the page loads. Pixels are packed row by row as R, G, B bytes. A 16-byte block does not line up with a pixel, so ECB turns a flat color into stripes that repeat every three blocks.