Block ciphers and modes: why ECB and raw CBC fail

// AES-128 as a keyed permutation of 16-byte blocks. node:crypto exposes the raw block function as 'aes-128-ecb' on a
// single block without padding, which is enough to run the cipher example of FIPS 197 Appendix B. Web Crypto offers
// no such call at all.
import { createCipheriv, createDecipheriv } from 'node:crypto';

const hex = (bytes) => Buffer.from(bytes).toString('hex');
const KEY = Buffer.from('2b7e151628aed2a6abf7158809cf4f3c', 'hex'); // FIPS 197, Appendix B
const INPUT = Buffer.from('3243f6a8885a308d313198a2e0370734', 'hex');
const OUTPUT = '3925841d02dc09fbdc118597196a0b32';

/** One call of the block function: 16 bytes in, 16 bytes out, under one key. */
function aes(key, block, direction = 'encrypt') {
  const cipher = direction === 'encrypt' ? createCipheriv('aes-128-ecb', key, null) : createDecipheriv('aes-128-ecb', key, null);
  cipher.setAutoPadding(false);
  return Buffer.concat([cipher.update(block), cipher.final()]);
}
const bitsSet = (byte) => byte.toString(2).replaceAll('0', '').length;
const bitsDiffer = (a, b) => a.reduce((n, x, i) => n + bitsSet(x ^ b[i]), 0);

const out = aes(KEY, INPUT);
console.log(`AES-128(key, input) = ${hex(out)}`);
console.log(`  as FIPS 197 Appendix B: ${hex(out) === OUTPUT}`);
console.log(`  the same block and key again: ${hex(aes(KEY, INPUT))}`);
console.log(`  the inverse cipher gives the input back: ${hex(aes(KEY, out, 'decrypt')) === hex(INPUT)}`);

const otherKey = Buffer.from(KEY);
otherKey[15] ^= 0x01; // the key's last bit
console.log(`one key bit changed: ${bitsDiffer(aes(otherKey, INPUT), out)} of 128 output bits differ`);

try {
  const cipher = createCipheriv('aes-128-ecb', KEY, null);
  cipher.setAutoPadding(false);
  cipher.update(Buffer.alloc(17));
  cipher.final();
} catch (error) {
  console.log(`17 bytes, no mode, no padding: ${error.code}`);
}
try {
  await crypto.subtle.importKey('raw', KEY, 'AES-ECB', false, ['encrypt']);
} catch (error) {
  console.log(`Web Crypto asked for 'AES-ECB': ${error.name}: ${error.message}`);
}

AES-128(key, input) = 3925841d02dc09fbdc118597196a0b32
  as FIPS 197 Appendix B: true
  the same block and key again: 3925841d02dc09fbdc118597196a0b32
  the inverse cipher gives the input back: true
one key bit changed: 58 of 128 output bits differ
17 bytes, no mode, no padding: ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH
Web Crypto asked for 'AES-ECB': NotSupportedError: Unrecognized algorithm name

// A picture of a padlock, 24 cells wide and 9 high, where every cell is one 16-byte block: 16 bytes of 0x00 for the
// paper, 16 bytes of 0xff for the ink. It is encrypted three ways under one key, and each ciphertext block is drawn as
// its first hex digit, which is all an observer of the ciphertext needs. The key, IV and counter are fixed lab values
// so that the run repeats; real code draws a random key and a fresh IV or nonce for every message.
import { createCipheriv } from 'node:crypto';

const PICTURE = [
  '........................',
  '.........######.........',
  '........##....##........',
  '........##....##........',
  '......############......',
  '......#####..#####......',
  '......#####..#####......',
  '......############......',
  '........................',
];
const WIDTH = PICTURE[0].length;
const plaintext = Buffer.concat(PICTURE.join('').split('').map((cell) => Buffer.alloc(16, cell === '#' ? 0xff : 0x00)));

const KEY = Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex'); // lab values, never a real key
const IV = Buffer.from('a0a1a2a3a4a5a6a7a8a9aaabacadaeaf', 'hex');

const ecb = createCipheriv('aes-128-ecb', KEY, null).setAutoPadding(false).update(plaintext);
const key = await crypto.subtle.importKey('raw', KEY, 'AES-CBC', false, ['encrypt']);
const cbc = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CBC', iv: IV }, key, plaintext));
const ctrKey = await crypto.subtle.importKey('raw', KEY, 'AES-CTR', false, ['encrypt']);
const ctr = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CTR', counter: IV, length: 64 }, ctrKey, plaintext));

function draw(name, bytes) {
  const blocks = [];
  for (let i = 0; i < plaintext.length; i += 16) blocks.push(Buffer.from(bytes.subarray(i, i + 16)).toString('hex'));
  const rows = [];
  for (let r = 0; r < PICTURE.length; r++) rows.push(blocks.slice(r * WIDTH, (r + 1) * WIDTH).map((b) => b[0]).join(''));
  console.log(`${name}: ${blocks.length} blocks, ${new Set(blocks).size} different`);
  for (const row of rows) console.log(`  ${row}`);
}

draw('plaintext', plaintext);
draw('ECB', ecb);
draw('CBC', cbc);
draw('CTR', ctr);

plaintext: 216 blocks, 2 different
  000000000000000000000000
  000000000ffffff000000000
  00000000ff0000ff00000000
  00000000ff0000ff00000000
  000000ffffffffffff000000
  000000fffff00fffff000000
  000000fffff00fffff000000
  000000ffffffffffff000000
  000000000000000000000000
ECB: 216 blocks, 2 different
  cccccccccccccccccccccccc
  ccccccccc333333ccccccccc
  cccccccc33cccc33cccccccc
  cccccccc33cccc33cccccccc
  cccccc333333333333cccccc
  cccccc33333cc33333cccccc
  cccccc33333cc33333cccccc
  cccccc333333333333cccccc
  cccccccccccccccccccccccc
CBC: 216 blocks, 216 different
  5e992d08c1ae1821be217e87
  9c10a6d7a59e5ae0864ce0fd
  4c7437deb25cc955b4d6d589
  7c7b013b6683cec749649448
  4b80b0badf3d677375042ccf
  a256fbb1704b7837f4a9e5e4
  c55e310ea3dcdcd3544caf2d
  978dac7a92b9ab82e335599d
  b104ee580940c2701254a088
CTR: 216 blocks, 216 different
  51a1be1dd6304bdae9eb31b8
  a8eadb3980717523785c4320
  cd26486c13fa72b304fa5e68
  69cc8ba59834b31c111cba17
  5c94ea81f15a9108be401432
  35df36d925426be7e18a490d
  831ca7326ffe206a7530462d
  c5ca14e956bc703495f29967
  df17b1dfdf973974b9eb2fe0

// AES-CBC and AES-CTR in Web Crypto against NIST SP 800-38A examples F.2.1 and F.5.5, the sizes CBC's padding gives,
// and what one fixed IV does to two messages that start with the same 16 bytes.
const fromHex = (h) => Uint8Array.from(h.match(/../g).map((x) => parseInt(x, 16)));
const hex = (bytes) => Buffer.from(bytes).toString('hex');
const PLAIN = fromHex(
  '6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710',
);

// F.2.1 CBC-AES128.Encrypt
const cbcKey = await crypto.subtle.importKey('raw', fromHex('2b7e151628aed2a6abf7158809cf4f3c'), 'AES-CBC', false, ['encrypt']);
const cbc = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CBC', iv: fromHex('000102030405060708090a0b0c0d0e0f') }, cbcKey, PLAIN));
const F21 = '7649abac8119b246cee98e9b12e9197d5086cb9b507219ee95db113a917678b273bed6b8e3c1743b7116e69e222295163ff1caa1681fac09120eca307586e1a7';
console.log(`CBC, F.2.1: ${PLAIN.length} bytes in, ${cbc.length} out; the first 64 as NIST's: ${hex(cbc.subarray(0, 64)) === F21}`);

// F.5.5 CTR-AES256.Encrypt: the rightmost 64 bits of the counter block are incremented
const ctrKey = await crypto.subtle.importKey('raw', fromHex('603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4'), 'AES-CTR', false, ['encrypt']);
const ctr = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CTR', counter: fromHex('f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff'), length: 64 }, ctrKey, PLAIN));
const F55 = '601ec313775789a5b7a7f504bbf3d228f443e3ca4d62b59aca84e990cacaf5c52b0930daa23de94ce87017ba2d84988ddfc9c58db67aada613c2dd08457941a6';
console.log(`CTR, F.5.5: ${PLAIN.length} bytes in, ${ctr.length} out; as NIST's: ${hex(ctr) === F55}`);

// Padding: CBC rounds every message up to whole blocks and always adds at least one byte; CTR keeps the length.
const sizes = [0, 1, 15, 16, 17, 32];
const cbcSizes = [];
const ctrSizes = [];
for (const n of sizes) {
  const data = new Uint8Array(n);
  cbcSizes.push((await crypto.subtle.encrypt({ name: 'AES-CBC', iv: new Uint8Array(16) }, cbcKey, data)).byteLength);
  ctrSizes.push((await crypto.subtle.encrypt({ name: 'AES-CTR', counter: new Uint8Array(16), length: 64 }, ctrKey, data)).byteLength);
}
console.log(`plaintext bytes   ${sizes.map((n) => String(n).padStart(3)).join('')}`);
console.log(`CBC ciphertext    ${cbcSizes.map((n) => String(n).padStart(3)).join('')}`);
console.log(`CTR ciphertext    ${ctrSizes.map((n) => String(n).padStart(3)).join('')}`);

// Two messages whose first 16 bytes are equal, under a fixed IV and under a fresh random IV each.
const enc = new TextEncoder();
const first = enc.encode('patient=4211;ward=B;drug=insulin');
const second = enc.encode('patient=4211;ward=B;drug=heparin');
const fixedIv = new Uint8Array(16);
const sameStart = async (ivA, ivB) => {
  const a = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CBC', iv: ivA }, cbcKey, first));
  const b = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CBC', iv: ivB }, cbcKey, second));
  return hex(a.subarray(0, 16)) === hex(b.subarray(0, 16));
};
console.log(`one fixed IV: the first ciphertext blocks are equal: ${await sameStart(fixedIv, fixedIv)}`);
const random = () => crypto.getRandomValues(new Uint8Array(16));
console.log(`a fresh random IV each: the first ciphertext blocks are equal: ${await sameStart(random(), random())}`);

CBC, F.2.1: 64 bytes in, 80 out; the first 64 as NIST's: true
CTR, F.5.5: 64 bytes in, 64 out; as NIST's: true
plaintext bytes     0  1 15 16 17 32
CBC ciphertext     16 16 16 32 32 48
CTR ciphertext      0  1 15 16 17 32
one fixed IV: the first ciphertext blocks are equal: true
a fresh random IV each: the first ciphertext blocks are equal: false

// The tamper check, run on AES-CBC: change one bit of each byte of IV || ciphertext in turn, as corruption or
// interference in transit would, and count the changed messages that decrypt without an error. A sound format
// refuses all of them. The key and IV are fixed lab values so that the run repeats.
const fromHex = (h) => Uint8Array.from(h.match(/../g).map((x) => parseInt(x, 16)));
const shown = (bytes) => Array.from(bytes, (b) => (b >= 0x20 && b < 0x7f ? String.fromCharCode(b) : '·')).join('');

const KEY = fromHex('000102030405060708090a0b0c0d0e0f'); // lab values, never a real key
const IV = fromHex('a0a1a2a3a4a5a6a7a8a9aaabacadaeaf');
const MESSAGE = new TextEncoder().encode('ship=standard;qty=0002;ref=73;'); // 30 bytes: two blocks, the second padded

const key = await crypto.subtle.importKey('raw', KEY, 'AES-CBC', false, ['encrypt', 'decrypt']);
const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CBC', iv: IV }, key, MESSAGE));
const blob = Uint8Array.from([...IV, ...ciphertext]); // what is stored or sent: 16 + 32 bytes

const parts = [
  { name: 'in the IV', from: 0, accepted: 0 },
  { name: 'in ciphertext block 1', from: 16, accepted: 0 },
  { name: 'in ciphertext block 2, the last', from: 32, accepted: 0 },
];
const seen = new Map();
for (let i = 0; i < blob.length; i++) {
  const changed = Uint8Array.from(blob);
  changed[i] ^= 0x01;
  try {
    const opened = new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-CBC', iv: changed.subarray(0, 16) }, key, changed.subarray(16)));
    parts[Math.floor(i / 16)].accepted += 1;
    seen.set(i, shown(opened));
  } catch {
    // OperationError: here only ever because the padding of the last block no longer reads as padding
  }
}
const total = parts.reduce((n, p) => n + p.accepted, 0);
console.log(`original:                "${shown(MESSAGE)}"`);
console.log('one-bit changes that decrypted without an error:');
for (const p of parts) console.log(`  ${p.name.padEnd(32)} ${String(p.accepted).padStart(2)} of 16`);
console.log(`IV byte 4 changed:       "${seen.get(4)}"`);
console.log(`block 1 byte 3 changed:  "${seen.get(19)}"`);
console.log(`the check expects 0 of ${blob.length} accepted: ${total === 0 ? 'pass' : `FAIL, ${total} accepted`}`);

original:                "ship=standard;qty=0002;ref=73;"
one-bit changes that decrypted without an error:
  in the IV                        16 of 16
  in ciphertext block 1            14 of 16
  in ciphertext block 2, the last   0 of 16
IV byte 4 changed:       "ship<standard;qty=0002;ref=73;"
block 1 byte 3 changed:  "<····H>····bs··Xy=0102;ref=73;"
the check expects 0 of 48 accepted: FAIL, 30 accepted

// Encrypt-then-MAC with Web Crypto: AES-256-CTR for confidentiality, HMAC-SHA-256 for integrity, two keys derived
// from one root key with HKDF, and a tag over the version, the counter block and the ciphertext that is checked
// before anything is decrypted. Then the tamper check of the CBC program, run on this format.
const enc = new TextEncoder();
const VERSION = 0x01;
const TAG = 32;

/** Two keys from one root key, one label each: never one key for both jobs. */
async function deriveKeys(rootBytes) {
  const root = await crypto.subtle.importKey('raw', rootBytes, 'HKDF', false, ['deriveKey']);
  const hkdf = (label) => ({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: enc.encode(label) });
  return {
    enc: await crypto.subtle.deriveKey(hkdf('etm v1 enc'), root, { name: 'AES-CTR', length: 256 }, false, ['encrypt', 'decrypt']),
    mac: await crypto.subtle.deriveKey(hkdf('etm v1 mac'), root, { name: 'HMAC', hash: 'SHA-256', length: 256 }, false, ['sign', 'verify']),
  };
}

class OpenError extends Error {}
let decryptions = 0;

async function seal(keys, plaintext) {
  const counter = new Uint8Array(16);
  crypto.getRandomValues(counter.subarray(0, 8)); // 8 random bytes, then a 64-bit block counter from zero
  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-CTR', counter, length: 64 }, keys.enc, plaintext));
  const body = Uint8Array.from([VERSION, ...counter, ...ciphertext]);
  const tag = new Uint8Array(await crypto.subtle.sign('HMAC', keys.mac, body));
  return Uint8Array.from([...body, ...tag]);
}

async function open(keys, blob) {
  if (blob.length < 1 + 16 + TAG || blob[0] !== VERSION) throw new OpenError('cannot open');
  const body = blob.subarray(0, blob.length - TAG);
  const tag = blob.subarray(blob.length - TAG);
  if (!(await crypto.subtle.verify('HMAC', keys.mac, tag, body))) throw new OpenError('cannot open'); // checked first
  decryptions += 1;
  return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-CTR', counter: body.subarray(1, 17), length: 64 }, keys.enc, body.subarray(17)));
}

const keys = await deriveKeys(new Uint8Array(32).fill(0x42)); // lab root keys, never real ones
const otherKeys = await deriveKeys(new Uint8Array(32).fill(0x43));
const text = 'ship=standard;qty=0002;ref=73;';
const blob = await seal(keys, enc.encode(text));
const opened = new TextDecoder().decode(await open(keys, blob));
console.log(`sealed: 1 + 16 + ${text.length} + ${TAG} = ${blob.length} bytes; it opens to the message: ${opened === text}`);
decryptions = 0;

let accepted = 0;
for (let i = 0; i < blob.length; i++) {
  const changed = Uint8Array.from(blob);
  changed[i] ^= 0x01;
  try {
    await open(keys, changed);
    accepted += 1;
  } catch (error) {
    if (!(error instanceof OpenError)) throw error;
  }
}
console.log(`the check expects 0 of ${blob.length} accepted: ${accepted === 0 ? 'pass' : `FAIL, ${accepted} accepted`}`);

for (const [name, bad] of [
  ['the tag cut to 16 bytes', blob.subarray(0, blob.length - 16)],
  ['the first 48 bytes only', blob.subarray(0, 48)],
  ['version 2 in front', Uint8Array.from([0x02, ...blob.subarray(1)])],
  ['sealed under another root key', await seal(otherKeys, enc.encode(text))],
]) {
  try {
    await open(keys, bad);
    console.log(`  ${name}: opened, which is wrong`);
  } catch (error) {
    console.log(`  ${name}: ${error.message}`);
  }
}
console.log(`decryptions run on changed or bad blobs: ${decryptions}`);

sealed: 1 + 16 + 30 + 32 = 79 bytes; it opens to the message: true
the check expects 0 of 79 accepted: pass
  the tag cut to 16 bytes: cannot open
  the first 48 bytes only: cannot open
  version 2 in front: cannot open
  sealed under another root key: cannot open
decryptions run on changed or bad blobs: 0