A block cipher encrypts one fixed-size block at a time. A mode of operation describes how to apply it repeatedly to a longer message, while padding makes the final block fit. With AES, blocks are 16 bytes. section 4.3
The basic choices expose an important warning:
- ECB encrypts each block independently. Because encryption is deterministic, repeated plaintext blocks produce repeated ciphertext blocks and can reveal patterns. section 4.3
- PKCS#7 padding fills the final block with bytes whose value equals the padding length; a complete block receives a full block of padding. section 4.3
The encrypted penguin
Encrypting an image with ECB can leave the penguin recognizable because repeated regions remain repeated in the ciphertext. The ciphertext is encrypted, but its structure still leaks clues about the original.
