Modes of operationAcceptable
Cipher Block Chaining mode
Block cipher mode (confidentiality only)
How it works
Each plaintext block is XORed with the previous ciphertext block before encryption, and the first block is XORed with an IV. This hides patterns, unlike ECB. The plaintext must be padded to a whole number of blocks, and encryption is sequential although decryption can run in parallel.
Sizes: IV equal to the block size (128 bits for AES)
Status: Sound for confidentiality with an unpredictable IV and a MAC; prefer an AEAD mode.
Strengths
- Hides repeated plaintext when the IV is random
- Widely supported in older protocols and libraries
Weaknesses and known attacks
- Padding oracle attacks: if a system reveals whether padding was valid, an attacker can decrypt data without the key.
- BEAST (2011) exploited predictable IVs in TLS 1.0 CBC suites; Lucky Thirteen exploited timing in CBC padding checks.
- No integrity on its own; bit flips in one ciphertext block cause predictable changes in the next plaintext block.
Use it for
- Legacy compatibility, combined with encrypt-then-MAC
Don't use it for
- New protocols (use GCM or ChaCha20-Poly1305)
- Any setting where error messages could act as a padding oracle
Exam tip
CBC needs an IV that is unpredictable, not just unique. Padding oracle and BEAST are the CBC attacks to remember; TLS 1.3 removed CBC suites entirely.