144
Neither block ciphers nor stream ciphers can give us perfect security, in which an attacker can never recover a message as long as the communicating parties use the algorithm properly. For
each type of cipher, the security is, at best, a function of the key length. Its always possible to launch a brute-force attack, in which the attacker tries every possible key until the message
properly decrypts. If the key length is long enough, the attack will take so long on average as to be infeasible in practice.
Even if there was no better attack on an individual cipher than brute force, there are other issues that plague naive use of both types of cipher. Stream ciphers have the problem that a one-bit flip
of the ciphertext causes a one-bit flip in the decrypted plaintext. Obviously, stream ciphers need to be supplemented with data integrity checks. For such purposes, we recommend message
authentication codes MACs—see
Chapter 8 .
When used directly, block ciphers always encrypt a given block of data in the same way, and thus do not effectively conceal patterns in a stream of data. An attacker can keep a dictionary of known
plaintext blocks to known ciphertext blocks, which can often be useful in deciphering real messages. Additionally, an attacker can easily substitute one ciphertext block for another, often
with great success. There are ways to use ciphers that can solve these problems to some degree, which we discuss in the next section. Additionally, MACs can be used to thwart actual
modification attacks.
Stream ciphers are subject to a similar, more serious problem. Once you start encrypting using a given key, you must continue to generate new data in the keystream, or generate and exchange a
new key. If you start over using the same key, the security of the stream cipher is effectively lost. The solution is to never reuse keys when using a stream cipher. Dont even use the same key
across reboots.
6.1.2 Basic Block Cipher Modes
OpenSSL implements four common modes for block ciphers. Each of these modes can be used with every block cipher in the library, with the exception of DESX, which is defined as having
only a single mode of operation.
•
ECB Electronic Code Book mode is the basic mode of operation, in which the cipher takes a single block of plaintext and produces a single block of ciphertext. Data streams
are broken into blocks that are individually processed. Usually, this mode is padded to accommodate messages that arent a multiple of the ciphers block size length in fact, you
cannot avoid padding in OpenSSL prior to 0.9.7. Because of padding, the ciphertext can be up to a block longer than the plaintext. In addition, as previously mentioned, this mode
is highly susceptible to dictionary attacks. ECB is almost always the wrong mode for the job, because it is so difficult to use securely. We strongly recommend that you not use it
under any circumstances, unless you really know what youre doing. The biggest advantage of ECB over the other common modes is that messages can be encrypted in
parallel. However, this is not an adequate reason to use ECB—an alternative mode that allows for parallelization is counter mode, which we discuss later in this chapter.
•
CBC Cipher Block Chaining mode essentially solves ECBs dictionary problem by XORing the ciphertext of one block with the plaintext of the next block. Since block
ciphertexts are interdependent, parallelization isnt possible. CBC is still a block-based mode, meaning that padding is generally used.
CBC mode can be used to encrypt multiple data streams. However, dictionary attacks are possible if the data streams have common beginning sequences. For that reason, it is
possible to set an initialization vector IV, which is a block of data that gets XORd with the first block of plaintext before encrypting that block. The value of the IV need not be
secret, but it should be random. The IV must be available to properly decrypt the ciphertext.
145
•
CFB Cipher Feedback mode is one way of turning a block cipher into a stream cipher, though a complete block of plaintext must be received before encryption can begin. This
mode isnt as prone to data manipulation attacks as most stream ciphers. Like CBC mode, CFB mode can use an initialization vector. The IV is more important than in CBC mode,
because if two data streams are encrypted with the same key, and have the same IV, then both streams can be recovered. In practice, avoid reusing the same key when using CFB
mode.
•
OFB Output Feedback mode is another way of turning a block cipher into a stream cipher. OFB mode works more like a traditional stream cipher than CFB mode, and is
therefore more susceptible to the same kind of bit-flipping attacks that affect stream ciphers generally not a problem if you use a message authentication code. A compelling
feature of OFB mode is that most of the work can be done offline. That is, you can generate a keystream before there is even data available to encrypt, while you have spare
CPU cycles. The plaintext simply gets XORd into the keystream. OpenSSL doesnt directly support keystream precomputation. OFB mode can also use an IV. As with CBC
mode, avoid using the same key to encrypt multiple data streams, particularly if you always use the same IV.
6.2 Encrypting with the EVP API
