Block Ciphers Explained: AES, DES, and Modes of Operation

Encrypt the same image in ECB mode and you can still see the image in the ciphertext. The outlines, the shapes, the patterns are all visible in the encrypted data. This is why ECB (Electronic Codebook) mode is banned in every serious security standard. The algorithm might be AES-256, but the mode matters more than the algorithm.

A block cipher encrypts data in fixed-size blocks. AES uses 128-bit blocks. DES uses 64-bit blocks. The block size, the key size, and the mode of operation together determine the security of the encryption. Get any one of them wrong and the whole system fails.

You can experiment with AES, DES, and their modes using our Block Cipher (AES/DES) tool, which uses the Web Crypto API for AES operations.

A block cipher is a symmetric encryption algorithm that processes data in fixed-size blocks. The block size is determined by the algorithm: AES uses 128-bit (16-byte) blocks, DES uses 64-bit (8-byte) blocks. The key size is variable: AES supports 128, 192, and 256-bit keys.

The cipher works by applying a series of mathematical transformations (called "rounds") to the block. Each round takes the block and the round key (derived from the main key through a key schedule) and produces an intermediate result. After all rounds are complete, the output is the ciphertext block.

AES (Advanced Encryption Standard), specified in FIPS 197, was standardized in 2001 after a five-year public competition. The winning algorithm, Rijndael, was designed by Joan Daemen and Vincent Rijmen. AES processes 128-bit blocks through 10 rounds (AES-128), 12 rounds (AES-192), or 14 rounds (AES-256).

Each AES round consists of four steps: - SubBytes: Each byte of the block is replaced using a nonlinear substitution table (S-box). This provides confusion. - ShiftRows: Each row of the 4x4 byte matrix is shifted left by a different amount. This provides diffusion. - MixColumns: Each column of the matrix is mixed using a mathematical operation over a finite field. This provides more diffusion. - AddRoundKey: The round key is XORed with the block. This incorporates the key.

The final round omits MixColumns. The result is a 128-bit ciphertext block that is statistically indistinguishable from random noise.

In December 2024, NIST announced plans to standardize a wider variant of AES with 256-bit blocks (Rijndael-256) to address performance needs for processing large volumes of data where the 128-bit block size creates limitations. Public comments were due by June 2025.

DES (Data Encryption Standard), specified in FIPS 46-3, was the US federal encryption standard from 1977 to 2002. It uses 64-bit blocks and a 56-bit key. The 56-bit key is the problem.

The key space of DES is 2^56, approximately 72 quadrillion combinations. In 1998, the Electronic Frontier Foundation (EFF) built a machine called "Deep Crack" for $250,000 that could brute-force a DES key in an average of 4.5 days. By 2006, a university research group could break DES in under a day using FPGA clusters. Today, a DES key can be brute-forced in hours on cloud computing infrastructure for a few thousand dollars.

3DES (Triple DES) was the interim replacement. It applies DES three times with two or three different keys, providing an effective key size of 112 or 168 bits. 3DES was widely used in banking and payment systems (EMV card encryption, PIN block encryption) for decades.

NIST formally deprecated 3DES in SP 800-131A, disallowing it for new applications after 2023 and requiring its phase-out for all applications by 2024. The reason is not just the small block size (64 bits), which creates birthday-bound collision risks after encrypting approximately 2^32 blocks (about 32 GB of data), but also the Sweet32 attack published in 2016 by Karthikeyan Bhargavan and Gaetan Leurent, which demonstrated practical attacks on 3DES in TLS and OpenVPN.

If you encounter 3DES in a production system today, replace it with AES-256-GCM. There is no scenario where 3DES is preferable to AES.

A block cipher encrypts one block at a time. To encrypt data longer than one block, you need a mode of operation. The mode determines how multiple blocks are chained together.

ECB (Electronic Codebook): Each block is encrypted independently with the same key. This is the simplest mode and the most insecure. If two plaintext blocks are identical, the corresponding ciphertext blocks are identical. This leaks patterns. The "ECB penguin" demonstration (encrypting an image of Tux the Linux penguin in ECB mode and showing that the penguin is still visible in the ciphertext) is the standard illustration of why ECB should never be used for data longer than one block. ECB is specified in NIST SP 800-38A but with explicit warnings against its use for bulk data.

CBC (Cipher Block Chaining): Each plaintext block is XORed with the previous ciphertext block before encryption. The first block is XORed with an initialization vector (IV). This ensures identical plaintext blocks produce different ciphertext blocks. CBC is secure for confidentiality but does not provide authentication. It is vulnerable to padding oracle attacks (like the POODLE attack on SSLv3) if the implementation leaks information about whether padding is correct.

CTR (Counter): A counter value is encrypted to produce a keystream, which is XORed with the plaintext. CTR mode turns a block cipher into a stream cipher. It allows parallel encryption and random access to ciphertext blocks. CTR is secure for confidentiality but does not provide authentication.

GCM (Galois/Counter Mode): CTR mode with added authentication. GCM produces both ciphertext and a 16-byte authentication tag. If any bit of the ciphertext is modified, the tag verification fails. GCM is specified in NIST SP 800-38D and is the recommended mode for virtually all applications. TLS 1.3 supports only GCM and ChaCha20-Poly1305 for authenticated encryption.

The critical rule for GCM: Never reuse a nonce (number used once) with the same key. Reusing a nonce allows an attacker to XOR two ciphertexts and recover plaintext. This is the same vulnerability that broke the one-time pad when the Soviets reused keys (the Venona project).

Block ciphers process fixed-size blocks. If the plaintext is not a multiple of the block size, it must be padded. The standard padding scheme is PKCS#7: if 4 bytes of padding are needed, the value 0x04 is appended four times. If 1 byte is needed, 0x01 is appended once. The padding is removed after decryption by reading the last byte's value and stripping that many bytes.

The problem with CBC mode and padding is the padding oracle attack. If a system decrypts ciphertext and returns different error messages for "invalid padding" versus "invalid MAC" (or simply behaves differently), an attacker can use this oracle to decrypt ciphertext byte by byte without knowing the key.

The POODLE attack (2014) exploited this in SSLv3. The Lucky13 attack (2013) exploited timing differences in TLS CBC implementations. The solution is to use authenticated encryption (GCM or ChaCha20-Poly1305) instead of CBC, or to encrypt-then-MAC (compute the MAC over the ciphertext, not the plaintext).

For virtually all applications in 2026, the answer is AES-256-GCM. It provides confidentiality and authentication in a single operation, is hardware-accelerated on modern CPUs (AES-NI), and is supported by every modern TLS implementation.

If you are working in an environment without hardware AES acceleration (some ARM devices, older hardware), ChaCha20-Poly1305 is the alternative. It provides the same security properties as AES-GCM but is faster in software. It is specified in RFC 8439 and is the other authenticated encryption option in TLS 1.3.

Never use ECB for bulk data. Never use CBC without a separate MAC (or use encrypt-then-MAC). Never reuse a nonce in GCM. Our Block Cipher tool lets you compare ECB, CBC, and GCM modes on the same input so you can see the difference.

AES itself has no known practical cryptanalytic attacks. The vulnerabilities in block cipher systems come from the mode of operation, key management, and implementation errors, not from the algorithm.

The birthday bound is a limitation for large data volumes. For AES with 128-bit blocks, after encrypting 2^64 blocks (approximately 295 exabytes) with the same key, the probability of two ciphertext blocks colliding becomes significant. For GCM, the birthday bound limits the amount of data encrypted under a single key to approximately 64 GB per nonce. For most applications, this is not a concern, but for high-throughput systems, key rotation is necessary.

Post-quantum security: AES-256 is resistant to quantum attacks. Grover's algorithm reduces its effective security to 128 bits, which remains adequate. AES-128 is reduced to 64 bits under Grover's algorithm, which is marginal. This is why NIST recommends AES-256 for post-quantum systems.