Block Ciphers & Modes

• AES structure and key schedule
• GF(2^8) math for MixColumns
• ECB vs CBC vs CTR
• Padding and padding oracles
• Malleability and integrity

Block cipher model

• Keyed permutation on fixed-size blocks
• Deterministic for a fixed key
• Needs a mode for real data

AES round

• SubBytes (S-box)
• ShiftRows (permute)
• MixColumns (diffuse)
• AddRoundKey (XOR)

AES-128 = 10 rounds

MixColumns intuition

• Linear mixing in GF(2^8)
• Spreads one-byte changes across a column
• Invertible for decryption

Key schedule

• RotWord + SubWord + Rcon
• 11 round keys for AES-128
• Byte order mistakes are common bugs

ECB

• Encrypt each block independently
• Leaks structure
• Never use for structured data

CBC

• Ci = Enc(Pi XOR C(i-1))
• Requires unpredictable IV
• Malleable: flip bits in C(i-1) to flip Pi

CTR

• Keystream = Enc(nonce || counter)
• Ciphertext = plaintext XOR keystream
• Nonce reuse breaks confidentiality

Padding and oracles

• PKCS#7 always adds padding
• Bad error handling -> padding oracle

Integrity

• CBC and CTR do NOT provide integrity
• Use Encrypt-then-MAC or AEAD

What you will build

• AES-128 block cipher
• CBC + PKCS#7
• CTR mode
• CBC bitflipping attack