Block Ciphers: Rounds and Modes

in reviewThis lesson is complete and being validated before release - details may still change.

Block ciphers

Loading interactive demo…

The left grid is the plaintext, a 16 by 16 bit image whose sixteen tiles are the cipher's blocks; the right grid is the ciphertext, filling tile by tile. The upper strip is the round keys; the lower strip follows one block through chaining, key mixing, S-boxes, permutations, and output, as hex. Tap a tile in either grid to follow that block.Take the tour, or press and explore. Legend:

The panel beside the stage is the real SpnCipher class from the published library executing in your browser, with the current line highlighted.

A 1 bit of the picture.
The block under way, and the round key or state being produced.
The block the strip follows.
A ciphertext tile equal to an earlier one: the pattern a mode leaks.
Tiles the run has not reached yet, ghosted.

mode is codebook or chaining, plain repeats how many plaintext tiles equal an earlier one, cipher repeats the same count in the ciphertext, round trip whether decrypting gave the plaintext back. The seed draws the key and the IV; Reseed draws new ones.

The code panel shows bare executable code by default. The bar above it names the file (hover the name for the full published path); options holds the toggles: comments, the tracer instrumentation that produces this visualization, and verbose names for the terse identifiers (display only: the default is the byte-exact published file). The view switch adds plain-English narration: both interleaves it with the code, pseudo shows only the pseudocode. hide code collapses the panel; the rail it leaves behind brings it back.

Keys: Space play/pause · ←/→ step · Home/End jump · R reset · F fullscreen · G guided tour

A keyed permutation. A block cipher with block size $n$ and key $k$ is a bijection $E_k$ on $\{0,1\}^n$ with an inverse $D_k$ that is cheap to compute given $k$ . The security goal is that without $k$ , $E_k$ is indistinguishable from a permutation chosen at random from all $2^n!$ of them. Here $n = 16$ and the key has $32$ bits; AES has $n = 128$ and keys of $128$ to $256$ bits.

Confusion and diffusion. Shannon's recipe: confusion makes the relation between key and ciphertext complicated, and the S-box provides it, a nonlinear table so that no linear equation in the key bits holds for every input. Diffusion spreads each input bit over many output bits, and the permutation provides it, moving the four output bits of each S-box into four different S-boxes for the next round. Neither alone is a cipher; alternated for enough rounds they make every output bit a complicated function of every input and key bit. The rounds slider shows how many rounds that takes at this size.

Why the last round has no permutation. A permutation of known structure applied after the last S-box can be undone by anyone, so it adds no security; the final key mixing is what hides the last S-box's output. Every SPN, AES included, drops it.

Modes. The cipher handles one block. A message is many, and a mode says how. Electronic codebook,

c_i = E_k(p_i) ,

encrypts each block alone, so $p_i = p_j$ gives $c_i = c_j$ : the picture's repeated tiles repeat in the ciphertext, and its shape survives. Cipher block chaining,

c_i = E_k(p_i \oplus c_{i-1}), \qquad c_{-1} = \text{IV} ,

feeds each block the previous ciphertext, so equal plaintext blocks enter as different inputs. The IV must be fresh for every message, or two messages with the same opening encrypt alike up to the first difference. Counter mode, used by GCM, instead encrypts a counter and xors the result with the plaintext, turning the block cipher into a stream cipher that can be computed in parallel.

What chaining does not do. CBC hides patterns; it does not stop tampering. Flip a bit of $c_{i-1}$ and the same bit of $p_i$ flips on decryption, predictably, while $p_{i-1}$ turns to garbage. A recipient who only decrypts cannot tell. Authenticated encryption adds a tag computed over the ciphertext, and TLS has required it since the padding-oracle attacks on CBC in the 2010s.

Breaking the toy. Four rounds over a 16-bit block fall to differential cryptanalysis with a few hundred chosen plaintexts, and a 32-bit key falls to $2^{32}$ trials in seconds; the point of the stage is the shape, which at $128$ bits and $10$ rounds has held since 2001.

Choices worth reading closely in the implementation (the code panel's comments and tracer checkboxes reveal the full published file):

Three private methods hold the three tags, mixKey, substitute, and permute, and both encryptBlock and decryptBlock call them, so the inverse reads as the rounds in reverse with the inverse S-box and nothing else changed.
pbox is its own inverse, a transpose of the 4 by 4 bit grid, which is why decryption needs no inverse permutation; the test checks the involution.
run decrypts through an untraced instance, so the trace holds the encryption alone and the round trip is a verdict in the done event rather than a second run through the rounds.
identical counts cipher blocks equal to an earlier one, the quantity codebook mode leaks and chaining mode drives to zero; it is the number the lesson's picture makes visible.

Claude Shannon's 1949 paper named the two things a cipher needs, confusion and diffusion, and suggested getting them by alternating simple substitutions with simple transpositions, many times over. Horst Feistel built that at IBM in the early 1970s as Lucifer, which became the Data Encryption Standard in 1977 and ran the world's banking for two decades. The differential and linear attacks of the 1990s were worked out against exactly the substitution-permutation shape on the stage, and the competition that replaced DES chose Rijndael, a substitution-permutation network, as AES in 2001.

1949Claude Shannon - Defines confusion and diffusion in 'Communication Theory of Secrecy Systems' and proposes product ciphers that alternate substitution and transposition.source
1971Horst Feistel - Designs Lucifer at IBM, the first block cipher built from rounds of S-boxes and permutations under a key.source
1977NBS and IBM - Publish the Data Encryption Standard, 64-bit blocks under a 56-bit key through sixteen Feistel rounds; its S-boxes turn out to have been hardened against attacks not yet public.source
1990Eli Biham and Adi Shamir - Publish differential cryptanalysis, which follows how a difference between two plaintexts propagates through the S-boxes, and show why DES's S-boxes resist it.source
1993Mitsuru Matsui - Publishes linear cryptanalysis, approximating S-boxes by linear equations that hold slightly more than half the time, and breaks DES with 2 to the 43 known plaintexts.source
2001Joan Daemen and Vincent Rijmen - Their Rijndael, a substitution-permutation network over 128-bit blocks, is standardised as AES after a public competition.source

Used today

Everything encrypted at rest and in flight - AES under a mode encrypts disks, databases, and every TLS connection's records; the handshake lesson ends by sending one.
Authenticated encryption - Modern modes such as GCM combine the cipher with a check value, since chaining alone lets an attacker flip bits in the plaintext by flipping them in the ciphertext.
Hardware - AES rounds are single instructions on most CPUs since 2010, which is why a laptop encrypts gigabytes a second.

picture

mode

rounds4

mode: codebook
plain repeats: 15 of 16
cipher repeats: 15 of 16
round trip: yes

spn-cipher.ts

import type { Tracer } from "../trace";/** A block is sixteen bits: four nibbles through four S-boxes, a 4 by 4 transpose between rounds. */export const BLOCK_BITS = 16;export const KEY_BITS = 32;export const DEFAULT_ROUNDS = 4;export const MAX_ROUNDS = 4;/** Sixteen blocks are the stage's 16 by 16 bit image. */export const MAX_BLOCKS = 16;/** Heys' S-box, the one every tutorial on linear and differential cryptanalysis is written against. */export const SBOX: readonly number[] = [0xe, 0x4, 0xd, 0x1, 0x2, 0xf, 0xb, 0x8, 0x3, 0xa, 0x6, 0xc, 0x5, 0x9, 0x0, 0x7];export const INVERSE_SBOX: readonly number[] = SBOX.map((_, output) => SBOX.indexOf(output));export type CipherMode = "ecb" | "cbc";export interface SpnRun {  plain: number[];  cipher: number[];  roundKeys: number[];  mode: CipherMode;  iv: number;  initialVector: number;  decrypted: number[];  roundTrip: boolean;  /** Cipher blocks equal to an earlier cipher block: the pattern a mode leaks. */  identical: number;}const MASK16 = 0xffff;const rotl16 = (word: number, n: number): number => ((word << n) | (word >>> (16 - n))) & MASK16;/** * A substitution-permutation network, the shape of AES at toy size: * each round xors a round key into the 16-bit block, pushes each * nibble through the S-box, and transposes the bits as a 4 by 4 grid, * so that after a few rounds every output bit depends on every input * bit and every key bit (confusion from the S-box, diffusion from the * permutation). A block cipher is a keyed permutation of blocks, not * a cipher for messages: a mode decides how blocks relate. Electronic * codebook encrypts each block alone and so maps equal blocks to * equal blocks, which leaks the shape of the plaintext; cipher block * chaining xors each block with the previous ciphertext first, so * equal blocks differ and the pattern is gone. Four rounds and a * 32-bit key are far too few to be secure; they are enough to see * the mechanism. * * Time: O(rounds) per block. Space: O(1) beyond the blocks. */export class SpnCipher {  constructor(    private readonly tracer?: Tracer,    readonly rounds: number = DEFAULT_ROUNDS,  ) {    if (!Number.isInteger(rounds) || rounds < 1 || rounds > MAX_ROUNDS) throw new RangeError(`rounds must be a whole number from 1 to ${MAX_ROUNDS}, got ${rounds}`);  }  /** The bit permutation: bit 4i + j of the input becomes bit 4j + i, the transpose of a 4 by 4 grid, its own inverse. */  static pbox(state: number): number {    let out = 0;    for (let i = 0; i < BLOCK_BITS; i++) {      if (state & (1 << i)) out |= 1 << (4 * (i % 4) + Math.floor(i / 4));    }    return out;  }  /** The round keys: one per round plus a final whitening key, each the key's halves folded, rotated, and offset by the round. */  schedule(key: number): number[] {    if (!Number.isInteger(key) || key < 0 || key > 0xffffffff) throw new RangeError(`the key is ${KEY_BITS} bits, got ${key}`);    const folded = ((key & MASK16) ^ (key >>> 16)) & MASK16;    const keys: number[] = [];    for (let round = 0; round <= this.rounds; round++) {      const roundKey = rotl16(folded, (3 * round) % 16) ^ ((0x9e37 * (round + 1) + ((key >>> ((round * 8) % 32)) & 0xff)) & MASK16);      keys.push(roundKey);      // ▸ one round key per round and a final one, all from the 32-bit key      this.tracer?.emit("schedule", { round, key: roundKey, keyHex: roundKey.toString(16).padStart(4, "0") });    }    return keys;  }  private mixKey(state: number, key: number, round: number, block: number): number {    const after = (state ^ key) & MASK16;    // ▸ xor the round key in: the only place the key touches the block    this.tracer?.emit("mix", { block, round, before: state, key, after });    return after;  }  private substitute(state: number, box: readonly number[], round: number, block: number): number {  private substitute(state: number, substitutionBox: readonly number[], round: number, block: number): number {    let after = 0;    const nibbles: number[] = [];    for (let i = 0; i < 4; i++) {      const nibble = box[(state >>> (4 * i)) & 0xf]!;      const nibble = substitutionBox[(state >>> (4 * i)) & 0xf]!;      nibbles.unshift(nibble);      after |= nibble << (4 * i);    }    // ▸ push each nibble through the s-box: confusion    this.tracer?.emit("sub", { block, round, before: state, after, nibbles });    return after;  }  private permute(state: number, round: number, block: number): number {    const after = SpnCipher.pbox(state);    // ▸ transpose the bits as a 4 by 4 grid: diffusion    this.tracer?.emit("perm", { block, round, before: state, after });    return after;  }  /** One block through the rounds: key, S-box, permutation, with no permutation in the last round and a final key. */  encryptBlock(block: number, roundKeys: readonly number[], index: number): number {    let state = block & MASK16;    for (let round = 0; round < this.rounds; round++) {      state = this.mixKey(state, roundKeys[round]!, round, index);      state = this.substitute(state, SBOX, round, index);      if (round < this.rounds - 1) state = this.permute(state, round, index);    }    return this.mixKey(state, roundKeys[this.rounds]!, this.rounds, index);  }  /** The rounds undone in reverse order with the inverse S-box; the permutation is its own inverse. */  decryptBlock(cipher: number, roundKeys: readonly number[], index: number): number {    let state = this.mixKey(cipher & MASK16, roundKeys[this.rounds]!, this.rounds, index);    for (let round = this.rounds - 1; round >= 0; round--) {      if (round < this.rounds - 1) state = this.permute(state, round, index);      state = this.substitute(state, INVERSE_SBOX, round, index);      state = this.mixKey(state, roundKeys[round]!, round, index);    }    return state;  }  /** Every block under the mode: alone in ECB, xored with the previous cipher block in CBC, the first with the IV. */  encrypt(blocks: readonly number[], roundKeys: readonly number[], mode: CipherMode, iv: number): number[] {  encrypt(blocks: readonly number[], roundKeys: readonly number[], mode: CipherMode, initialVector: number): number[] {    if (blocks.length > MAX_BLOCKS) throw new RangeError(`at most ${MAX_BLOCKS} blocks, got ${blocks.length}`);    const cipher: number[] = [];    let previous = iv & MASK16;    let previous = initialVector & MASK16;    blocks.forEach((plain, block) => {      let input = plain & MASK16;      if (mode === "cbc") {        input = (input ^ previous) & MASK16;        // ▸ in cbc, xor the previous cipher block into this one first        this.tracer?.emit("chain", { block, previous, before: plain & MASK16, after: input });      }      const out = this.encryptBlock(input, roundKeys, block);      cipher.push(out);      previous = out;      // ▸ the block is encrypted; equal inputs give equal outputs      this.tracer?.emit("output", { block, plain: plain & MASK16, cipher: out, mode });    });    return cipher;  }  /** The inverse of encrypt under the same mode and IV. */  decrypt(cipher: readonly number[], roundKeys: readonly number[], mode: CipherMode, iv: number): number[] {  decrypt(cipher: readonly number[], roundKeys: readonly number[], mode: CipherMode, initialVector: number): number[] {    const plain: number[] = [];    let previous = iv & MASK16;    let previous = initialVector & MASK16;    cipher.forEach((block, index) => {      let out = this.decryptBlock(block, roundKeys, index);      if (mode === "cbc") out = (out ^ previous) & MASK16;      plain.push(out);      previous = block & MASK16;    });    return plain;  }  /** Schedule the key, encrypt the blocks under the mode, decrypt them untraced to check the round trip, and count repeated cipher blocks. */  run(blocks: readonly number[], key: number, mode: CipherMode, iv: number): SpnRun {  run(blocks: readonly number[], key: number, mode: CipherMode, initialVector: number): SpnRun {    const roundKeys = this.schedule(key);    const cipher = this.encrypt(blocks, roundKeys, mode, iv);    const cipher = this.encrypt(blocks, roundKeys, mode, initialVector);    const decrypted = new SpnCipher(undefined, this.rounds).decrypt(cipher, roundKeys, mode, iv);    const decrypted = new SpnCipher(undefined, this.rounds).decrypt(cipher, roundKeys, mode, initialVector);    const plain = blocks.map((b) => b & MASK16);    const roundTrip = decrypted.length === plain.length && decrypted.every((b, i) => b === plain[i]);    const identical = cipher.filter((c, i) => cipher.indexOf(c) < i).length;    return { plain, cipher, roundKeys, mode, iv: iv & MASK16, decrypted, roundTrip, identical };    return { plain, cipher, roundKeys, mode, initialVector: initialVector & MASK16, decrypted, roundTrip, identical };  }}

mode =: ecb
repeats =: 15
roundTrip =: yes

Codebook mode: the plaintext had 15 repeated blocks, the ciphertext has 15. Decrypting gives the plaintext back.

import type { Tracer } from "../trace";/** A block is sixteen bits: four nibbles through four S-boxes, a 4 by 4 transpose between rounds. */export const BLOCK_BITS = 16;export const KEY_BITS = 32;export const DEFAULT_ROUNDS = 4;export const MAX_ROUNDS = 4;/** Sixteen blocks are the stage's 16 by 16 bit image. */export const MAX_BLOCKS = 16;/** Heys' S-box, the one every tutorial on linear and differential cryptanalysis is written against. */export const SBOX: readonly number[] = [0xe, 0x4, 0xd, 0x1, 0x2, 0xf, 0xb, 0x8, 0x3, 0xa, 0x6, 0xc, 0x5, 0x9, 0x0, 0x7];export const INVERSE_SBOX: readonly number[] = SBOX.map((_, output) => SBOX.indexOf(output));export type CipherMode = "ecb" | "cbc";export interface SpnRun { plain: number[]; cipher: number[]; roundKeys: number[]; mode: CipherMode; iv: number; initialVector: number; decrypted: number[]; roundTrip: boolean; /** Cipher blocks equal to an earlier cipher block: the pattern a mode leaks. */ identical: number;}const MASK16 = 0xffff;const rotl16 = (word: number, n: number): number => ((word << n) | (word >>> (16 - n))) & MASK16;/** * A substitution-permutation network, the shape of AES at toy size: * each round xors a round key into the 16-bit block, pushes each * nibble through the S-box, and transposes the bits as a 4 by 4 grid, * so that after a few rounds every output bit depends on every input * bit and every key bit (confusion from the S-box, diffusion from the * permutation). A block cipher is a keyed permutation of blocks, not * a cipher for messages: a mode decides how blocks relate. Electronic * codebook encrypts each block alone and so maps equal blocks to * equal blocks, which leaks the shape of the plaintext; cipher block * chaining xors each block with the previous ciphertext first, so * equal blocks differ and the pattern is gone. Four rounds and a * 32-bit key are far too few to be secure; they are enough to see * the mechanism. * * Time: O(rounds) per block. Space: O(1) beyond the blocks. */export class SpnCipher { constructor( private readonly tracer?: Tracer, readonly rounds: number = DEFAULT_ROUNDS, ) { if (!Number.isInteger(rounds) || rounds < 1 || rounds > MAX_ROUNDS) throw new RangeError(`rounds must be a whole number from 1 to ${MAX_ROUNDS}, got ${rounds}`); } /** The bit permutation: bit 4i + j of the input becomes bit 4j + i, the transpose of a 4 by 4 grid, its own inverse. */ static pbox(state: number): number { let out = 0; for (let i = 0; i < BLOCK_BITS; i++) { if (state & (1 << i)) out |= 1 << (4 * (i % 4) + Math.floor(i / 4)); } return out; } /** The round keys: one per round plus a final whitening key, each the key's halves folded, rotated, and offset by the round. */ schedule(key: number): number[] { if (!Number.isInteger(key) || key < 0 || key > 0xffffffff) throw new RangeError(`the key is ${KEY_BITS} bits, got ${key}`); const folded = ((key & MASK16) ^ (key >>> 16)) & MASK16; const keys: number[] = []; for (let round = 0; round <= this.rounds; round++) { const roundKey = rotl16(folded, (3 * round) % 16) ^ ((0x9e37 * (round + 1) + ((key >>> ((round * 8) % 32)) & 0xff)) & MASK16); keys.push(roundKey); // ▸ one round key per round and a final one, all from the 32-bit key this.tracer?.emit("schedule", { round, key: roundKey, keyHex: roundKey.toString(16).padStart(4, "0") }); } return keys; } private mixKey(state: number, key: number, round: number, block: number): number { const after = (state ^ key) & MASK16; // ▸ xor the round key in: the only place the key touches the block this.tracer?.emit("mix", { block, round, before: state, key, after }); return after; } private substitute(state: number, box: readonly number[], round: number, block: number): number { private substitute(state: number, substitutionBox: readonly number[], round: number, block: number): number { let after = 0; const nibbles: number[] = []; for (let i = 0; i < 4; i++) { const nibble = box[(state >>> (4 * i)) & 0xf]!; const nibble = substitutionBox[(state >>> (4 * i)) & 0xf]!; nibbles.unshift(nibble); after |= nibble << (4 * i); } // ▸ push each nibble through the s-box: confusion this.tracer?.emit("sub", { block, round, before: state, after, nibbles }); return after; } private permute(state: number, round: number, block: number): number { const after = SpnCipher.pbox(state); // ▸ transpose the bits as a 4 by 4 grid: diffusion this.tracer?.emit("perm", { block, round, before: state, after }); return after; } /** One block through the rounds: key, S-box, permutation, with no permutation in the last round and a final key. */ encryptBlock(block: number, roundKeys: readonly number[], index: number): number { let state = block & MASK16; for (let round = 0; round < this.rounds; round++) { state = this.mixKey(state, roundKeys[round]!, round, index); state = this.substitute(state, SBOX, round, index); if (round < this.rounds - 1) state = this.permute(state, round, index); } return this.mixKey(state, roundKeys[this.rounds]!, this.rounds, index); } /** The rounds undone in reverse order with the inverse S-box; the permutation is its own inverse. */ decryptBlock(cipher: number, roundKeys: readonly number[], index: number): number { let state = this.mixKey(cipher & MASK16, roundKeys[this.rounds]!, this.rounds, index); for (let round = this.rounds - 1; round >= 0; round--) { if (round < this.rounds - 1) state = this.permute(state, round, index); state = this.substitute(state, INVERSE_SBOX, round, index); state = this.mixKey(state, roundKeys[round]!, round, index); } return state; } /** Every block under the mode: alone in ECB, xored with the previous cipher block in CBC, the first with the IV. */ encrypt(blocks: readonly number[], roundKeys: readonly number[], mode: CipherMode, iv: number): number[] { encrypt(blocks: readonly number[], roundKeys: readonly number[], mode: CipherMode, initialVector: number): number[] { if (blocks.length > MAX_BLOCKS) throw new RangeError(`at most ${MAX_BLOCKS} blocks, got ${blocks.length}`); const cipher: number[] = []; let previous = iv & MASK16; let previous = initialVector & MASK16; blocks.forEach((plain, block) => { let input = plain & MASK16; if (mode === "cbc") { input = (input ^ previous) & MASK16; // ▸ in cbc, xor the previous cipher block into this one first this.tracer?.emit("chain", { block, previous, before: plain & MASK16, after: input }); } const out = this.encryptBlock(input, roundKeys, block); cipher.push(out); previous = out; // ▸ the block is encrypted; equal inputs give equal outputs this.tracer?.emit("output", { block, plain: plain & MASK16, cipher: out, mode }); }); return cipher; } /** The inverse of encrypt under the same mode and IV. */ decrypt(cipher: readonly number[], roundKeys: readonly number[], mode: CipherMode, iv: number): number[] { decrypt(cipher: readonly number[], roundKeys: readonly number[], mode: CipherMode, initialVector: number): number[] { const plain: number[] = []; let previous = iv & MASK16; let previous = initialVector & MASK16; cipher.forEach((block, index) => { let out = this.decryptBlock(block, roundKeys, index); if (mode === "cbc") out = (out ^ previous) & MASK16; plain.push(out); previous = block & MASK16; }); return plain; } /** Schedule the key, encrypt the blocks under the mode, decrypt them untraced to check the round trip, and count repeated cipher blocks. */ run(blocks: readonly number[], key: number, mode: CipherMode, iv: number): SpnRun { run(blocks: readonly number[], key: number, mode: CipherMode, initialVector: number): SpnRun { const roundKeys = this.schedule(key); const cipher = this.encrypt(blocks, roundKeys, mode, iv); const cipher = this.encrypt(blocks, roundKeys, mode, initialVector); const decrypted = new SpnCipher(undefined, this.rounds).decrypt(cipher, roundKeys, mode, iv); const decrypted = new SpnCipher(undefined, this.rounds).decrypt(cipher, roundKeys, mode, initialVector); const plain = blocks.map((b) => b & MASK16); const roundTrip = decrypted.length === plain.length && decrypted.every((b, i) => b === plain[i]); const identical = cipher.filter((c, i) => cipher.indexOf(c) < i).length; return { plain, cipher, roundKeys, mode, iv: iv & MASK16, decrypted, roundTrip, identical }; return { plain, cipher, roundKeys, mode, initialVector: initialVector & MASK16, decrypted, roundTrip, identical }; }}