Block Cipher Modes of Operation — the mode carries the CTF vulnerability, not the primitive

A block cipher (AES, DES) only encrypts one fixed-size block; a *mode of operation* extends it to arbitrary-length messages — and in CTF crypto the mode, not the primitive, is almost always where the vulnerability lives. Identify the mode first, then route to the named attack.

The signal that gives it away

Read the shape of what you're given before touching any math:

- Ciphertext length is a multiple of the block size (8 bytes for DES/3DES, 16 for AES) → a block-chained mode is in play (ECB or CBC). - Ciphertext length exactly equals plaintext length (no padding, no rounding) → a stream-like mode: CTR, CFB, or OFB. - Ciphertext length equals plaintext length plus a trailing tag → GCM (the extra bytes are the authentication tag). Don't assume that trailing chunk is fixed at 16 bytes: NIST SP 800-38D allows GCM tag lengths of 128, 120, 112, 104, or 96 bits, and while most libraries default to a full 16-byte (128-bit) tag, a 12-byte (96-bit) tag is also common in practice (e.g. TLS AES-GCM cipher suites) — check the actual tag length the target library/spec uses before subtracting it from the ciphertext to isolate the tag. - What ships alongside the ciphertext narrows it further: only ciphertext (nothing else) → likely ECB, or CBC with a fixed/implicit IV; ciphertext + IV → CBC/CFB/OFB; ciphertext + nonce or counter → CTR; ciphertext + tag → GCM. - Identical plaintext blocks producing identical ciphertext blocks is the unambiguous ECB tell — feed a long run of repeated bytes (or repeat an entire block) and diff the output blocks. - A distinguishable "bad padding" vs "bad ciphertext/other error" response on a CBC-shaped ciphertext is the tell for the padding-oracle sub-attack — it's a property of the *implementation*, not of CBC itself, so don't assume it's present just because the mode is CBC. - Block size itself is often unknown up front: feed the encryption oracle inputs of increasing length one byte at a time and watch for the point where total ciphertext length jumps — the jump size is the block size.

How to exploit — route by mode

``python def looks_ecb(ct, bs=16): blocks = [ct[i:i+bs] for i in range(0, len(ct), bs)] return len(blocks) != len(set(blocks)) # duplicate block => ECB ``

- ECB — each block is encrypted independently, so identical plaintext blocks leak identical ciphertext blocks. This enables byte-at-a-time decryption (grow a chosen prefix one byte and compare block output) and cut-and-paste/block splicing (reorder or duplicate whole ciphertext blocks when you control block-aligned input, e.g. swapping a role=user block for an attacker-supplied role=admin block). See ECB Detection & Cut-and-Paste — the identical-block signal and how to weaponize it. - CBC — c_i = E(p_i ⊕ c_{i-1}), with c_0 = IV. Two distinct attacks depending on what capability the challenge gives you: - a decryption oracle that only leaks padding-valid/padding-invalid → CBC Padding Oracle — leak the intermediate decryption value one byte at a time, recovers plaintext byte-by-byte without ever recovering the key. - the ability to tamper with ciphertext and observe the *effect* on plaintext (no oracle needed) → CBC Bit-Flipping — controlled tampering with no oracle needed: flipping a bit in c_{i-1} flips the same bit position in p_i after decryption, while p_{i-1} itself is scrambled to garbage. No key material is touched. - CTR — keystream = E(nonce ‖ counter), c = p ⊕ keystream. This is a stream mode: reusing the same (nonce, counter) pair across two messages reproduces the same keystream, collapsing the scheme into a many-time pad. XOR the two ciphertexts to cancel the keystream and crib-drag the result. See CTR Nonce Reuse — when the counter mode keystream repeats and the general umbrella Stream-Cipher Keystream Reuse — the umbrella break behind every reused-keystream challenge / One-Time-Pad / Many-Time-Pad Reuse — the crib-drag break when a pad is used twice. - CFB/OFB — also turn the block cipher into a stream cipher via feedback, and inherit the same nonce/IV-reuse fragility as CTR. They are not interchangeable in effect: OFB iterates E on its own output to build the keystream (pure stream-cipher structure), while CFB feeds the *ciphertext* back into E (self-synchronizing) — this changes how a tampered ciphertext block propagates on decryption, so don't reuse CBC bit-flipping intuition here unmodified. - GCM — CTR-mode encryption plus a GHASH polynomial MAC. Nonce reuse here is worse than the usual stream-cipher many-time-pad leak: reusing a (key, nonce) pair leaks the authentication key H itself, because the tag is the evaluation of a polynomial at H — the "forbidden attack" (Joux, during NIST's GCM standardization review). Once H is recovered, you can forge a valid tag for *any* ciphertext under that key, without ever touching the encryption key. Route to MAC Forgery — the construction, not the primitive, decides the attack once H is in hand.

What does NOT work

- Concluding ECB from "no duplicate blocks in one short ciphertext." Absence of a repeated block is not proof of CBC/CTR — a short message may simply never repeat a full block even under ECB. You need either a long/controlled plaintext (chosen-plaintext with an intentionally repeated run) or several independent ciphertexts of the same input before the ECB signal is trustworthy. - Running the padding-oracle attack against a CBC service with no distinguishable padding-error signal. If the server catches all decryption failures identically (or the scheme is custom and never validates PKCS#7 padding at all), there is no oracle and the byte-by-byte technique has nothing to exploit — check whether a *different* boolean signal exists (timing, response size) before giving up; that's a job for Error / Boolean Oracle Attack — turn any distinguishable valid/invalid response into a key or plaintext or Timing Attack — recovering a secret from how long a secret-dependent operation takes, not for assuming padding-oracle applies by mode alone. - Reusing the CBC bit-flipping mental model ("flip affects the next block") on a CTR/CFB/OFB-derived stream ciphertext. In those modes a ciphertext bit flip changes the *same-position* plaintext bit directly (it's a pure XOR with keystream), not the corresponding position one block later as in CBC. Applying the CBC offset rule here targets the wrong bit and produces nonsense output. - Expecting a CBC-padding-oracle-style byte-at-a-time attack against GCM tag verification. A correct GCM implementation performs a single pass/fail check over the whole ciphertext+tag with a constant-time comparison, by design — it does not leak partial/positional information the way an unpadded PKCS#7 check does. If a GCM oracle *does* leak byte-by-byte timing on tag comparison, that's an implementation bug to chase as Timing Attack — recovering a secret from how long a secret-dependent operation takes, not evidence that GCM-the-mode is weak the way CBC padding is. - Declaring "nonce reuse" from ciphertext prefixes looking similar when the nonce isn't actually visible or provably identical (e.g. it's derived from a hidden counter or session id you can't observe directly). Confirm reuse by encrypting two known/chosen plaintexts yourself and directly comparing the overlapping keystream region, rather than inferring it from superficial ciphertext similarity.

Related

ECB Detection & Cut-and-Paste — the identical-block signal and how to weaponize it CBC Padding Oracle — leak the intermediate decryption value one byte at a time CBC Bit-Flipping — controlled tampering with no oracle needed CTR Nonce Reuse — when the counter mode keystream repeats Stream-Cipher Keystream Reuse — the umbrella break behind every reused-keystream challenge One-Time-Pad / Many-Time-Pad Reuse — the crib-drag break when a pad is used twice MAC Forgery — the construction, not the primitive, decides the attack Error / Boolean Oracle Attack — turn any distinguishable valid/invalid response into a key or plaintext Timing Attack — recovering a secret from how long a secret-dependent operation takes Cryptanalysis Methodology — classify the family before you reach for an attack