Symmetric Encryption: AES Mode Comparison

By the end of this lesson you can:

• Explain what a block-cipher "mode of operation" is and why it matters.
• Show why ECB is broken (the penguin) and must never be used.
• Compare CBC (needs IV + separate MAC) with GCM (authenticated in one step).
• Choose GCM as the default — and know when to just use Fernet instead.

AES encrypts data one fixed-size block (16 bytes) at a time. But messages are bigger than one block — so how do you chain the blocks together? That choice is the mode of operation, and it's where security is won or lost. Same strong cipher, wildly different safety.

ECB — Electronic CodeBook (never use)

Each 16-byte block encrypted INDEPENDENTLY with the same key:
  block A → cipher X
  block A → cipher X   ← identical input ALWAYS gives identical output
So repeated patterns in the plaintext survive into the ciphertext.

CBC — Cipher Block Chaining (legacy, careful)

Each block is XORed with the PREVIOUS ciphertext before encrypting:
  block 1 ⊕ IV          → cipher 1
  block 2 ⊕ cipher 1    → cipher 2   ← chaining hides patterns
Needs: a random IV (never reused), correct padding, AND a separate MAC.

CBC fixes ECB's pattern leak via chaining and a random initialization vector (IV). But CBC alone gives no integrity — you must add a separate HMAC (encrypt-then-MAC), and mistakes here cause real attacks (padding oracles). CBC is legacy; only use it if you must, and always with a MAC.

GCM — Galois/Counter Mode (modern default)

Encrypts (counter mode) AND produces an authentication TAG in one pass.
  output: ciphertext + 16-byte tag
  decrypt verifies the tag first → tampering = rejected, like Fernet.
Needs: a unique nonce per message (NEVER reuse a nonce with the same key).

GCM is authenticated encryption: confidentiality and integrity together, no separate MAC step. It's fast and the modern standard (TLS uses AES-GCM). The one rule: the nonce must be unique for each message under a given key — reuse is catastrophic.

Using AES-GCM correctly (when you must use raw AES)

import os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

key = AESGCM.generate_key(bit_length=256)   # 256-bit AES
aesgcm = AESGCM(key)

nonce = os.urandom(12)                        # 12-byte nonce, UNIQUE per message
ct = aesgcm.encrypt(nonce, b"secret data", associated_data=None)
# store nonce + ct together (nonce isn't secret, but must never repeat)

plain = aesgcm.decrypt(nonce, ct, associated_data=None)   # raises on tamper
print(plain.decode())

AESGCM from cryptography gives you authenticated AES with a clean API. You manage the nonce (12 random bytes per message, stored alongside the ciphertext). associated_data lets you authenticate (but not encrypt) extra context like a header.

...but usually, just use Fernet

Goal: a hands-on demo that makes ECB's flaw visible and shows GCM detecting tampering — so the "which mode" choice is concrete, not abstract.

import os
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

key = os.urandom(32)

# --- ECB leaks patterns: identical blocks → identical ciphertext ---
def aes_ecb(data: bytes) -> bytes:
    # 16-byte blocks; pad to a multiple of 16 for the demo
    data = data + b"\x00" * (-len(data) % 16)
    enc = Cipher(algorithms.AES(key), modes.ECB()).encryptor()   # NEVER in real code
    return enc.update(data) + enc.finalize()

# two identical 16-byte blocks of plaintext:
plaintext = b"AAAAAAAAAAAAAAAA" + b"AAAAAAAAAAAAAAAA"
ct = aes_ecb(plaintext)
print("ECB block 1 == block 2 ciphertext:", ct[:16] == ct[16:32])  # True → LEAK!

# --- GCM hides patterns AND detects tampering ---
aesgcm = AESGCM(key)
nonce = os.urandom(12)
gcm_ct = aesgcm.encrypt(nonce, plaintext, None)
print("GCM block 1 == block 2 ciphertext:", gcm_ct[:16] == gcm_ct[16:32])  # False

# tampering is caught by the auth tag:
from cryptography.exceptions import InvalidTag
tampered = bytearray(gcm_ct); tampered[0] ^= 1
try:
    aesgcm.decrypt(nonce, bytes(tampered), None)
except InvalidTag:
    print("GCM detected tampering — refused to decrypt ✓")

ECB block 1 == block 2 ciphertext: True   ← identical blocks leak!
GCM block 1 == block 2 ciphertext: False  ← patterns hidden
GCM detected tampering — refused to decrypt ✓

Read the code

The ECB output proves the flaw numerically: two identical 16-byte plaintext blocks produce byte-identical ciphertext, so any structure in the data shows through (the penguin). GCM, by contrast, makes them different (chaining/counter) and — like Fernet — rejects tampering via its authentication tag. This is why mode choice matters more than "is it AES?": AES-ECB is broken-by-mode, AES-GCM is solid. For real code you'd still reach for Fernet unless you specifically need GCM.

AES is a block cipher; the mode determines how blocks combine, and that's where security lives. ECB encrypts blocks independently so patterns leak (the penguin) — never use it. CBC chains with a random IV but needs a separate MAC and careful handling (legacy). GCM is authenticated encryption — confidentiality + integrity in one pass, the modern default — with the absolute rule that the nonce must never repeat under a key. In practice, prefer Fernet unless you specifically need GCM; the real-world skill is recognising dangerous mode choices in code reviews.