A block cipher is a keyed cryptographic algorithm that transforms fixed-size blocks of plaintext into ciphertext. Unlike a stream cipher, it processes several bytes together, providing both confusion and diffusion: confusion obscures plaintext–ciphertext relationships, while diffusion spreads each plaintext byte’s effect across many ciphertext bytes. section 5.0 section 5.6
Practical encryption requires more than choosing a cipher. Plaintext must fit complete blocks, so padding such as PKCS#7 may be added; multiple blocks also require a mode of operation. ECB is insecure, while CBC requires a unique initialization vector for every message. section 5.6
Important implementations illustrate changing security assumptions:
- DES uses 64-bit plaintext blocks and a nominal 64-bit key, but eight parity bits leave only 56 bits of security, making brute-force attacks practical. section 5.1
- 3DES applies DES three times with two or three keys, improving security but no longer providing enough protection for sensitive information. section 5.1
- AES operates on a 4×4 byte array with 128-, 192-, or 256-bit keys and 128-bit blocks; it remains secure against known practical attacks when used correctly. section 5.1
Attacks often bypass rather than break the cipher. A padding oracle can leak whether decrypted plaintext has valid padding through error behavior. CBC implementations can also fail when an IV is reused, as demonstrated by the BEAST attack against older web browsers. section 5.6
Figure 5.2 Stream ciphers encrypt bit/bytes at a time. Block ciphers operate on chunks of data.
Shows the essential contrast between byte-at-a-time stream encryption and chunk-based block encryption. section 5.0
