Symmetric encryption: block ciphers and modes of operation

AES (Advanced Encryption Standard) is a block cipher — it encrypts data in fixed-size chunks (128 bits at a time for AES), not an arbitrary stream of any length. Real data is almost never exactly one block long, which raises an immediate question a block cipher alone doesn't answer: what happens to the second block, and the third, and so on? The answer is a mode of operation — a scheme for applying the block cipher repeatedly across a full message.

The simplest possible mode, ECB (Electronic Codebook), encrypts each block independently, using the same key for every block:

The fatal flaw: identical plaintext blocks always produce identical ciphertext blocks. Encrypt an image with large areas of solid color using ECB, and the encrypted output still visibly shows the same shapes — the famous "ECB penguin" image, where a recognizable penguin silhouette remains clearly visible even after "encryption," because repeated identical blocks (the solid-color background) encrypt to the same repeated ciphertext pattern. ECB mode leaks structural information about the plaintext even though it never reveals the actual content — a real, demonstrated failure, not a theoretical concern.

CBC (Cipher Block Chaining) fixes this by XORing each plaintext block with the previous block's ciphertext before encrypting it, starting with a random initialization vector (IV) for the first block:

Now identical plaintext blocks produce different ciphertext, because each block's encryption depends on everything before it. This fixes ECB's pattern-leaking problem, but CBC has its own real requirements: the IV must be random and never reused with the same key, and CBC provides no protection against an attacker tampering with the ciphertext — a modified ciphertext often still decrypts to something (garbled, but without any built-in signal that tampering occurred).

GCM (Galois/Counter Mode) is the modern default for a reason it addresses directly: it encrypts the data and produces an authentication tag — a value that changes if even one bit of the ciphertext is altered afterward. Decrypting with GCM verifies this tag automatically; if it doesn't match, decryption fails outright instead of silently returning tampered data. This combined property — confidentiality plus tamper detection in one mode — is why GCM (or similar "authenticated encryption" modes) is the standard recommendation for new systems today, rather than plain CBC.

"We use AES" is an incomplete security claim — AES-128-ECB and AES-128-GCM use the identical underlying cipher and key size, and one of them visibly leaks plaintext structure while the other provides genuine confidentiality plus tamper detection. This is exactly the kind of detail Web Security's "we encrypt everything" discussion gestures at without spelling out — the choice of mode, not just the choice of algorithm, is what actually determines whether an encryption scheme is sound.