AES ECB & CBC Decryption

AES Fundamentals

AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST. It operates on fixed 128-bit (16-byte) blocks, with key sizes of 128, 192, or 256 bits. Because AES is a block cipher, plaintext must be processed in discrete chunks, necessitating a mode of operation to handle messages of arbitrary length.

ECB Mode (Electronic Code Book)

ECB is the simplest block cipher mode. Each 16-byte block is encrypted independently with the same key.

Mechanism:

Cᵢ = E(K, Pᵢ) where Cᵢ is ciphertext block, Pᵢ is plaintext block, K is the key

Critical Security Flaw: Identical plaintext blocks produce identical ciphertext blocks. This leaks structural information about the plaintext. The classic demonstration is the ECB penguin image, where patterns remain visible in encrypted bitmap data.

Property ECB Characteristic
Pattern leakage Severe - identical blocks reveal repetition
Parallelizable Yes (encryption and decryption)
Error propagation Single block only
Acceptable use Encrypting a single block, or data known to be uniformly random

ECB should be considered insecure for general use.

CBC Mode (Cipher Block Chaining)

CBC addresses ECB’s pattern leakage by XORing each plaintext block with the previous ciphertext block before encryption.

Mechanism:

C₀ = IV (Initialization Vector)
Cᵢ = E(K, Pᵢ ⊕ Cᵢ₋₁)

Decryption:

Pᵢ = D(K, Cᵢ) ⊕ Cᵢ₋₁

IV Requirements:

The IV must be unpredictable (random) and unique per encryption operation. A fixed or predictable IV undermines CBC’s security advantage.

Property CBC Characteristic
Pattern leakage None with random IV
Parallelizable Decryption only
Error propagation Affects current and next block
IV requirement Random, unique, need not be secret

CBC achieves indistinguishability from random bits when used correctly.

Padding

Block ciphers require input to be a multiple of the block size. ECB and CBC both require padding.

PKCS#7 Padding:

The most common scheme. Append N bytes, each with value N, where N is the number of bytes needed to reach the next block boundary.

For a 16-byte block size:

Python Implementation

Recently, I had to help decrypt some AES-ECB and AES-CBC offline. This is straightforward in Python as the cryptographic primitives are provided.

from cryptography.hazmat.primitives import padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

def decrypt_aes_ecb(key: bytes, ciphertext: bytes) -> bytes:
    """Decrypt AES-ECB ciphertext."""
    cipher = Cipher(algorithms.AES(key), modes.ECB(), backend=default_backend())
    decryptor = cipher.decryptor()
    decrypted_padded = decryptor.update(ciphertext) + decryptor.finalize()

    # Remove PKCS7 padding
    unpadder = padding.PKCS7(128).unpadder()
    plaintext = unpadder.update(decrypted_padded) + unpadder.finalize()
    return plaintext


def decrypt_aes_cbc(key: bytes, iv: bytes, ciphertext: bytes) -> bytes:
    """Decrypt AES-CBC ciphertext."""
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
    decryptor = cipher.decryptor()
    decrypted_padded = decryptor.update(ciphertext) + decryptor.finalize()

    # Remove PKCS7 padding
    unpadder = padding.PKCS7(128).unpadder()
    plaintext = unpadder.update(decrypted_padded) + unpadder.finalize()
    return plaintext

Key sizes:

IV size: Always 16 bytes for AES-CBC.

Security Summary

Consideration ECB CBC
Use in production No Acceptable with random IV
Pattern hiding None Yes
Better alternatives CBC, CTR, GCM GCM (provides authentication)

For new systems, authenticated encryption modes like AES-GCM are preferred as they provide both confidentiality and integrity. CBC only provides confidentiality.

Published on by Stanley