AES modes of operation: ECB, CBC and GCM

In short: AES encrypts only blocks of 16 bytes. The mode of operation defines how many blocks are processed securely. The choice decides security.

In more detail: Good practice today is GCM (or ChaCha20-Poly1305), because it encrypts and detects tampering at once. ECB is unusable.

In Depth

• ECB: Each block is encrypted independently. Equal plaintext blocks give equal ciphertext blocks, and patterns stay visible (the famous “ECB penguin” image). Do not use.
• CBC: Each block is combined (XOR) with the previous ciphertext block before encryption. Needs a random initialisation vector (IV) and padding. Without an extra checksum vulnerable to padding-oracle attacks.
• CTR: Turns AES into a stream cipher: a counter is encrypted and combined with the plaintext. Parallelisable, but without tamper protection.
• GCM: CTR plus an authentication tag. See AEAD.
• Rule: Never use the same key and nonce pair twice, which would be disastrous with GCM.

See also: Symmetric encryption