AES Modes Named

AES modes literacy names GCM, CBC, CTR, and ECB pitfalls — openssl demos on YOUR $CRYPTO_LAB generated keys only.

AES Modes Named• Audio Walkthrough

00:00/03:31

Visual · t28_aes_modes_named

AES modes literacy. $CRYPTO_LAB only. Original Cyberlium.

Mode matters as much as AES — literacy names AEAD vs legacy before you copy a Stack Overflow snippet.

AES modes: GCM and CCM provide authenticated encryption (confidentiality + integrity). CTR streams blocks with nonce — needs separate MAC if not AEAD wrapper. CBC chains blocks — padding oracle class when misused. ECB encrypts identical blocks to identical ciphertext — penguin pattern literacy. Cyberlium demos AES modes with openssl enc on YOUR $CRYPTO_LAB generated keys — never decrypt production captures without scope. Next: RSA Toy Named.

1. AES modes (named)

GCM: nonce + auth tag — default recommendation for new designs. CBC: IV required; padding errors enable oracle class — defender literacy only. CTR: counter mode stream — unique counter per message. ECB: avoid for structured data — identical blocks leak patterns.

On $CRYPTO_LAB, run openssl enc -aes-256-gcm demo on a file YOU wrote — note nonce and tag handling.

Command guide

Try these commands — AES modes (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Optional command

OpenSSL genrsa — https://www.openssl.org/docs/manmaster/man1/openssl-genrsa.html

NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final (2048-bit RSA minimum literacy) CWE-326 — https://cwe.mitre.org/data/definitions/326.html

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install openssl

macOS: Built-in

Windows:

Command — copy this

choco install openssl

═══ LINUX / macOS ═══

Command — copy this

export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
openssl genrsa -out "$CRYPTO_LAB/keys/lab-toy-2048.pem" 2048
chmod 600 "$CRYPTO_LAB/keys/lab-toy-2048.pem"
openssl rsa -in "$CRYPTO_LAB/keys/lab-toy-2048.pem" -pubout -out "$CRYPTO_LAB/keys/lab-toy-2048.pub.pem"
grep -E 'private keys|never publish' "$CRYPTO_LAB/roe.txt"

Primary tools to practice this lesson: openssl, grep. Reference sites: OpenSSL genrsa (https://www.openssl.org/docs/manmaster/man1/openssl-genrsa.html); NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); CWE-326 (https://cwe.mitre.org/data/definitions/326.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why mode literacy matters

Correct algorithm with wrong mode fails audits. Nonce reuse in GCM catastrophic — defender monitoring required. Library defaults (OpenSSL 3, libsodium) steer toward AEAD — students read docs before choosing CBC.

Incident reports cite mode misconfiguration — literacy supports remediation tickets.

3. Lab boundary

Forbidden: decrypting stranger AES blobs, ECB for real patient data because tutorial used it. Allowed: AES modes card — four modes, one-line risk/benefit, $CRYPTO_LAB openssl command sample.

Ship: AES modes card for YOUR lab demos. Next: RSA Toy Named.

4. What you ship: AES modes card for $CRYPTO_LAB

Four modes with risk notes. $CRYPTO_LAB openssl demo command. NO production ciphertext. chmod 600.

5. What you record before the next lesson

Date. AES modes card. $CRYPTO_LAB named. File t28-m05-l01-aes-modes-named.txt chmod 600.

6. Wrong vs right: prod crypto oracles vs CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Use ECB for real database columns. Reuse GCM nonce because lab is small.
Right: Write AES modes card for YOUR $CRYPTO_LAB openssl demos. Next: RSA Toy Named.

Hands-on Exercise