Start with one block

A block cipher transforms a fixed-size block of plaintext into a block of ciphertext of the same size, using a key. Decryption reverses that transformation with the key. A whole file can contain many blocks; one block is not necessarily one word, sentence, or file.

First, recall the units:

• A bit is a 0 or a 1.
• A byte is 8 bits.
• Plaintext is the original data. Ciphertext is its encrypted form.
• A secret key is a value that must remain unknown to the attacker.

plaintext block + secret key → encryption → ciphertext block
ciphertext block + same key  → decryption → plaintext block

AES is a symmetric block cipher: the same secret key supports encryption and decryption. The algorithm can be public. The key must be protected.

Worked example: a 128-bit block contains 128 ÷ 8 = 16 bytes. Encrypting one such block with the AES primitive returns one 16-byte block.

Try it: how many full 16-byte blocks fit into 48 bytes?

Why this matters: changing the message length, the block size, and the key size are different operations.

Block size is not key size

Block size tells us how much data the primitive processes at once. Key size tells us the length of the key.

The number in AES-256 names the key length. It does not mean 256-byte blocks or 256-bit blocks. These parameters are specified in NIST FIPS 197.

Worked example: switching a system from AES-128 to AES-256 changes the key length and round count. A 32-byte message still contains two 16-byte data blocks before any padding.

Try it: a 64-byte message uses AES-192. How many complete data blocks does it contain?

Try the Block Size and Key Size station above. Keep the message length fixed while changing only the key.

The same input under the same key gives the same block

For a fixed key, a block cipher is deterministic: the same plaintext block gives the same ciphertext block. It is also reversible. Two different input blocks cannot give the same output block under that fixed key, or decryption would not know which original to return.

This one-to-one mapping is called a permutation of the possible blocks. Here, permutation means a one-to-one mapping of complete block values. Later, we also use the word for rearranging bit positions inside a round.

A tiny two-bit example could map 00 → 10, 01 → 00, 10 → 11, and 11 → 01. Every possible output appears once. This tiny table is not secure encryption.

A secure block cipher is designed so an attacker without the key cannot feasibly distinguish its mapping from a randomly chosen permutation under the intended attack model. “It looks scrambled” is not a security test. A small block space could let an attacker collect a codebook of input/output pairs.

First learn XOR

XOR, pronounced “exclusive or,” combines two bits. Equal bits give 0; different bits give 1. It is not ordinary addition: there is no carry.

Work one column at a time:

data:   1100
key:    1010
XOR:    0110

undo:   0110 XOR 1010 = 1100

The first column is 1 XOR 1, so it becomes 0. The second is 1 XOR 0, so it becomes 1. Apply the same rule to the other two columns.

Try it: calculate 1001 XOR 0101.

XOR is useful for mixing a key into data and for reversing that mixing. Repeating a short XOR key over a message is not a secure encryption design.

Trace a small round

A round is one sequence of transformations in a cipher. Substitution replaces values according to a table. Rearrangement moves values to other positions. A round key is key material used at a particular stage; a key schedule derives round keys from the main key.

Our four-bit teaching round has three steps:

1. XOR the plaintext with the four-bit key.
2. Replace each two-bit pair using this table: 00 → 01, 01 → 11, 10 → 00, 11 → 10.
3. Rotate left one position: the old positions 2, 3, 4, 1 become the new positions 1, 2, 3, 4.

Worked example:

Plaintext                         1100
XOR with key 1010                  0110
Split into pairs                  01 | 10
Substitute using the table         11 | 00
Rotate 1100 left one position      1001

To reverse it, undo the last step first:

1001 → rotate right → 1100
11 | 00 → read table backward → 01 | 10
0110 XOR 1010 → 1100, the original plaintext

Try it: use plaintext 1001 and key 1010 with the same three steps.

Use the Small Reversible Round station to reveal one step at a time.

Important limit: this is a deliberately insecure four-bit model, not AES. Its table and rearrangement demonstrate reversibility, not the strength of AES or a guarantee that changing one bit will change many others. Making up a cipher from these operations does not make it safe.

What AES does with these ideas

AES treats its 16-byte block as a four-by-four array called the state, the data being transformed inside the algorithm.

• SubBytes: replace each byte with another using AES's specified substitution table.
• ShiftRows: move bytes within rows to different positions.
• MixColumns: combine bytes within each column, helping an input change affect other bytes.
• AddRoundKey: XOR the state with a round key.

AES begins with an AddRoundKey step, then applies its rounds. The final round omits MixColumns. Its real operations and key schedule are precisely specified; our classroom table is not a substitute.

Confusion makes the relationship between the key, plaintext, and ciphertext complicated. Diffusion spreads an input's influence across the output. Substitution and mixing work together over rounds. Rearranging values alone does not provide all that protection.

A Feistel network is another construction described in the chapter: it divides the block into halves and repeatedly combines and swaps them. AES uses a substitution-permutation structure, not a Feistel structure. You do not need to calculate either design's full internals here.

A mode handles a message

A mode of operation specifies how to use a block cipher across a message. Choosing AES does not, by itself, choose a mode or provide authentication.

ECB exposes repetition

Electronic Codebook, or ECB, encrypts each plaintext block separately under the same key.

Plaintext blocks:   A  B  A  C  A
Ciphertext blocks:  X  Q  X  R  X

The letters stand for complete blocks; they are not a real cipher alphabet. An observer sees that positions 1, 3, and 5 match, even without knowing what A means.

Try it: for ciphertext blocks M, T, T, M, which plaintext positions must match under the same ECB key?

Use Repeated Blocks in ECB to change a plaintext block or the example key. ECB is not an appropriate way to hide patterns in ordinary multi-block messages.

CBC chains blocks together

Cipher Block Chaining, or CBC, XORs a plaintext block with the previous ciphertext block before encryption. The first block has no predecessor, so it uses an initialization vector, or IV.

First block:  plaintext 1 XOR IV           → AES → ciphertext 1
Next block:   plaintext 2 XOR ciphertext 1 → AES → ciphertext 2

For CBC confidentiality, the IV must be unpredictable when the message is chosen; use the construction's supported generation method. The IV is not a secret key and can accompany the ciphertext. Its integrity also needs protection in a complete scheme.

Chaining removes ECB's simple “same plaintext block always yields the same ciphertext block” relationship across positions. It does not promise that ciphertext blocks can never coincide. CBC encryption depends on the previous encrypted block.

CTR generates a stream to XOR

Counter mode, or CTR, encrypts counter blocks to produce a keystream: values XORed with the plaintext.

nonce + counter 1 → AES → keystream 1
plaintext 1 XOR keystream 1 → ciphertext 1

A nonce distinguishes an encryption operation; a counter advances within it. The complete counter-block inputs must never repeat under the same key, including across messages. A unique message nonce plus a counter that never wraps is one way a construction may arrange this.

The nonce need not be secret or unpredictable merely to satisfy CTR's uniqueness requirement. Reusing the same key and counter sequence repeats the keystream and exposes relationships between messages. We examine that failure more closely in the stream-cipher topic.

CBC and CTR have different IV/nonce rules. Do not transfer one rule to every mode. NIST SP 800-38A specifies the confidentiality modes.

What if the last block is incomplete?

Padding adds bytes according to a defined rule. With CBC and PKCS#7 padding, enough bytes are added to reach the next 16-byte boundary. Each added byte contains the number of padding bytes.

Worked example: a 20-byte message contains 16 + 4 bytes. The last block needs 12 bytes, so add 12 padding bytes, each with decimal value 12. The encrypted padded data is 32 bytes. This does not count the IV, an authentication tag, or file headers.

Boundary case: a 16-byte message gets 16 padding bytes under this rule, making 32 bytes. Always adding padding lets the receiver remove it consistently.

Try it: a 29-byte message uses CBC with PKCS#7. How many padding bytes are added?

CTR does not need this padding. For a short final piece, XOR only the needed keystream bytes. An AES-based mode can therefore handle a partial message block without changing AES's underlying block size.

Strong encryption still needs safe use

Confidentiality protects against unauthorized reading. Integrity concerns detecting unauthorized changes. Plain CBC and plain CTR do not automatically authenticate ciphertext. A receiver cannot conclude “nobody changed this” just because decryption produced some bytes.

Authenticated encryption combines confidentiality with a way to detect unauthorized changes. Use an appropriate reviewed implementation and follow its key, nonce, and usage requirements; do not assemble a production system from classroom examples. The authenticated-encryption topic will develop this further.

The chapter also introduces:

• A side channel: information leaked by an implementation, such as secret-dependent timing. A correct algorithm on paper does not eliminate that risk.
• A padding oracle: observable behavior that tells an attacker whether modified ciphertext has valid padding. That feedback can reveal data. A generic error message alone does not guarantee that timing and other behavior stop leaking.
• A meet-in-the-middle attack: matching intermediate results from two directions. Repeated encryption does not automatically multiply security as advertised. This is different from intercepting communication between people.

You need to recognize the failure ideas, not implement these attacks. Use reviewed cryptographic libraries with appropriate side-channel defenses and authenticated encryption rather than designing your own fixes.

Reading guide

Read Serious Cryptography, second edition, Chapter 4, printed pages 61–85. Concentrate on block versus key size, the purpose of rounds, AES's named operations, ECB/CBC/CTR, and padding. Read the implementation and attack sections for the main risk, not the code or attack arithmetic.

No Python, command-line tools, or additional software are needed. All practice here is ungraded; Canvas holds the course assessment and deadline.

Explain the essentials

Use this page after the lesson. These are learning checks, not another graded quiz.

Vocabulary in plain language

The relationships to remember

• AES uses 128-bit / 16-byte blocks with 128-, 192-, or 256-bit keys.
• The same block and key produce the same block-cipher output.
• AES combines substitution, movement, mixing, and round-key addition. The small browser model is not AES.
• ECB reveals equal blocks under one key. More key bits do not fix that.
• CBC uses the previous ciphertext block; the first block uses an IV.
• CTR uses AES outputs as a keystream. Never repeat a complete counter input under the same key.
• CBC/PKCS#7 padding always adds between 1 and 16 bytes, even for a full final block.
• Plain CBC and CTR provide no automatic ciphertext authentication.

Work these without the controls

1. How many bytes are in a 128-bit block? Explain the division.
2. Trace 0101 XOR 1100, one bit at a time.
3. If one ECB ciphertext block appears three times, what does that show? What does it not show?
4. A message contains 31 bytes. How many bytes does CBC/PKCS#7 add?
5. Explain why changing a CBC IV rule into “always use zero” is unsafe.
6. Explain why CTR's uniqueness rule is about the full counter input and the key, not just a variable named nonce.

Avoid these common mistakes

“AES-256 has 256-bit blocks.” It still has 128-bit blocks.

“A reversible toy must be secure.” Reversibility allows decryption; it does not establish resistance to attack.

“Every mode needs a secret IV.” IVs and nonces can be public; their uniqueness, unpredictability, and integrity requirements depend on the construction.

“Padding is required whenever AES is used.” CBC/PKCS#7 uses padding; CTR handles a partial final piece without it.

“Decryption worked, so the message was not changed.” Successful decryption alone is not an authenticity check.

What to study for the Canvas quiz

Know the definitions, AES block/key distinction, a four-bit XOR, substitution versus rearrangement, ECB repetition, CBC's IV requirement, CTR reuse, the full-block padding case, and the need for authentication. You do not need to memorize AES's lookup table, perform finite-field arithmetic, write code, or execute an attack.