Enum CipherMode

Namespace

CryptoHives.Foundation.Security.Cryptography.Cipher

Assembly

CryptoHives.Foundation.Security.Cryptography.dll

Specifies the block cipher mode of operation.

[SuppressMessage("Design", "CA1008:Enums should have zero value", Justification = "Mirror runtime implementation")]
public enum CipherMode

Fields

CBC = 1

Cipher Block Chaining mode. Each plaintext block is XORed with the previous ciphertext block before encryption.

Requires an initialization vector (IV) for the first block. Provides better diffusion than ECB but is not parallelizable for encryption. Value matches CBC.

CCM = 102

Counter with CBC-MAC mode. Provides authenticated encryption with associated data (AEAD).

CCM is designed for constrained environments (IoT, embedded systems). It combines CTR mode encryption with CBC-MAC authentication.

CFB = 4

Cipher Feedback mode. Converts a block cipher into a self-synchronizing stream cipher.

Value matches CFB.

Provided for interoperability; prefer CTR or an AEAD mode for new designs. The segment size is FeedbackSize, 8 bits by default as in-box, and padding is applied to the segment size rather than the block size.

CTR = 100

Counter mode. Converts a block cipher into a stream cipher by encrypting successive counter values and XORing with plaintext.

CTR mode is parallelizable and allows random access to encrypted data. The nonce/counter combination must never repeat for the same key.

CTS = 5

Cipher Text Stealing mode. Handles plaintext that is not a multiple of the block size.

Value matches CTS.

Implemented as CBC-CS3, the variant used by Kerberos (RFC 3962): the last two ciphertext blocks are always swapped. Input must be at least one block long, the ciphertext is as long as the plaintext, and the padding mode is ignored.

ECB = 2

Electronic Codebook mode. Each block is encrypted independently.

Warning: ECB mode does not provide semantic security and should generally be avoided. Identical plaintext blocks produce identical ciphertext blocks, revealing patterns in the data. Value matches ECB.

GCM = 101

Galois/Counter Mode. Provides authenticated encryption with associated data (AEAD).

GCM combines CTR mode encryption with Galois field multiplication for authentication. It produces both ciphertext and an authentication tag.

Important: Nonce reuse completely breaks GCM security. Each (key, nonce) pair must be unique.

OFB = 3

Output Feedback mode. Converts a block cipher into a synchronous stream cipher.

Value matches OFB.

Provided for interoperability; prefer CTR or an AEAD mode for new designs. Like CTR it is a stream mode: the final partial block is not padded and the padding mode is ignored.

Stream = 200

Stream cipher mode. Used for ciphers like ChaCha20 that are natively stream ciphers.

Stream mode indicates the cipher operates on arbitrary-length data without block padding requirements.

Remarks

Block cipher modes determine how blocks of plaintext are processed and how they relate to each other during encryption/decryption.

Values for ECB, CBC, OFB, CFB and CTS match CipherMode for compatibility. Additional modes (CTR, GCM, CCM, Stream) extend beyond the system enum.

Security guidance:

• ECB should be avoided for most use cases due to lack of diffusion.
• GCM and CCM provide authenticated encryption (AEAD).
• CTR is suitable for streaming but requires unique nonces.