Modet e Bllokut dhe Nonce-t

A block cipher like AES encrypts exactly 128 bits at a time. To encrypt longer messages, you need a mode of operation.

The naive mode, ECB (Electronic Code Book), splits the message into 128-bit blocks and encrypts each independently. The problem is that identical plaintext blocks produce identical ciphertext blocks, so patterns leak through. The famous "ECB penguin" image illustrates this: an encrypted bitmap of a penguin in ECB mode is still visually recognizable as a penguin because solid-color regions encrypt to repeating patterns. ECB must never be used for anything that could repeat. CBC, CTR, CFB and OFB all introduce a per-message nonce or initialization vector (IV) that makes each encryption unique even when the plaintext repeats. CBC requires PKCS#7 padding and is susceptible to padding oracle attacks if used without authentication. CTR turns a block cipher into a stream cipher and is fine cryptographically but still needs a separate authentication mechanism. GCM (Galois/Counter Mode) combines CTR-mode encryption with a GHASH authentication step and produces a tag verified on decryption. This is the AEAD mode used by TLS 1.3, SSH, IPsec and most modern protocols. As long as nonces are never reused with the same key, AES-GCM is secure and fast — modern CPUs with AES-NI and PCLMULQDQ instructions can encrypt multiple gigabytes per second.

Mjete demonstruese:

• openssl enc -aes-256-ecb / -aes-256-cbc / -aes-256-gcm.
• CyberChef — vizualizim i modeve në shfletues.

Demo klasik i ECB mbi një imazh (Tux):

# Konverto në raw, kripto me ECB, shto header përsëri
convert tux.png -depth 8 rgb:tux.rgb
openssl enc -aes-256-ecb -K 000102...ff -in tux.rgb -out tux-ecb.rgb -nopad
convert -size $(identify tux.png | awk '{print $3}') -depth 8 rgb:tux-ecb.rgb tux-ecb.png

Modeli i sigurt (GCM):

openssl enc -aes-256-gcm -pbkdf2 -in secret.txt -out secret.enc

1. Kripto të njëjtin imazh me ECB dhe GCM. Krahaso rezultatet vizualisht.
2. Shkruaj në 3 rreshta pse ECB nuk duhet përdorur kurrë.

• Wikipedia — Block cipher mode of operation (ECB Penguin).
• NIST SP 800-38A.