Enum CipherMode

Namespace

CryptoHives.Foundation.Security.Cryptography.Cipher

Assembly

CryptoHives.Foundation.Security.Cryptography.dll

Specifies the block cipher mode of operation.

[SuppressMessage("Design", "CA1008:Enums should have zero value", Justification = "Mirror runtime implementation")]
public enum CipherMode

Fields

CBC = 1

Cipher Block Chaining mode. Each plaintext block is XORed with the previous ciphertext block before encryption.

Requires an initialization vector (IV) for the first block. Provides better diffusion than ECB but is not parallelizable for encryption. Value matches CBC.

CCM = 102

Counter with CBC-MAC mode. Provides authenticated encryption with associated data (AEAD).

CCM is designed for constrained environments (IoT, embedded systems). It combines CTR mode encryption with CBC-MAC authentication.

[Obsolete("CFB is not implemented. Use CTR or an AEAD mode (GCM, CCM, ChaCha20-Poly1305) instead. CFB was designed for self-synchronization on noisy serial links, which is irrelevant on modern reliable transports.")] CFB = 4

Cipher Feedback mode. Converts a block cipher into a self-synchronizing stream cipher.

Value matches CFB.

Obsolete: CFB was designed for environments requiring self-synchronization after bit errors (e.g. noisy serial links), a property irrelevant on modern reliable transports. Modern protocols use AEAD modes (GCM, CCM, ChaCha20-Poly1305) which provide both confidentiality and integrity. CFB is retained for compatibility but is not implemented in this library.

CTR = 100

Counter mode. Converts a block cipher into a stream cipher by encrypting successive counter values and XORing with plaintext.

CTR mode is parallelizable and allows random access to encrypted data. The nonce/counter combination must never repeat for the same key.

[Obsolete("CTS is not implemented. Use CTR or an AEAD mode (GCM, CCM, ChaCha20-Poly1305) instead. CTS is a niche mode used primarily in Kerberos (RFC 3962); modern modes handle arbitrary-length data without padding.")] CTS = 5

Cipher Text Stealing mode. Handles plaintext that is not a multiple of the block size.

Value matches CTS.

Niche: CTS avoids ciphertext expansion by stealing bits from the penultimate block. It is used in Kerberos (RFC 3962) and some disk encryption schemes, but is otherwise uncommon. Modern AEAD modes and CTR mode handle arbitrary-length data without padding. CTS is retained for compatibility but is not implemented in this library.

ECB = 2

Electronic Codebook mode. Each block is encrypted independently.

Warning: ECB mode does not provide semantic security and should generally be avoided. Identical plaintext blocks produce identical ciphertext blocks, revealing patterns in the data. Value matches ECB.

GCM = 101

Galois/Counter Mode. Provides authenticated encryption with associated data (AEAD).

GCM combines CTR mode encryption with Galois field multiplication for authentication. It produces both ciphertext and an authentication tag.

Important: Nonce reuse completely breaks GCM security. Each (key, nonce) pair must be unique.

[Obsolete("OFB is not implemented. Use CTR or an AEAD mode (GCM, CCM, ChaCha20-Poly1305) instead. OFB is superseded by CTR which offers the same parallelism with simpler implementation.")] OFB = 3

Output Feedback mode. Converts a block cipher into a synchronous stream cipher.

Value matches OFB.

Obsolete: OFB is largely superseded by CTR mode, which offers the same parallelism and random-access benefits with simpler implementation. Modern protocols (TLS 1.3, QUIC, WireGuard, IPsec) exclusively use AEAD modes (GCM, CCM, ChaCha20-Poly1305) or CTR. OFB is retained for compatibility but is not implemented in this library.

Stream = 200

Stream cipher mode. Used for ciphers like ChaCha20 that are natively stream ciphers.

Stream mode indicates the cipher operates on arbitrary-length data without block padding requirements.

Remarks

Block cipher modes determine how blocks of plaintext are processed and how they relate to each other during encryption/decryption.

Values for ECB, CBC, OFB, and CFB match CipherMode for compatibility. Additional modes (CTR, GCM, CCM, Stream) extend beyond the system enum.

Security guidance:

• ECB should be avoided for most use cases due to lack of diffusion.
• GCM and CCM provide authenticated encryption (AEAD).
• CTR is suitable for streaming but requires unique nonces.