Advanced › Module 5 › Lesson 1
AES Modes Named
AES modes literacy names GCM, CBC, CTR, and ECB pitfalls — openssl demos on YOUR $CRYPTO_LAB generated keys only.
Visual · t28_aes_modes_named
AES modes literacy. $CRYPTO_LAB only. Original Cyberlium.
Opening
Mode matters as much as AES — literacy names AEAD vs legacy before you copy a Stack Overflow snippet.
AES modes: GCM and CCM provide authenticated encryption (confidentiality + integrity). CTR streams blocks with nonce — needs separate MAC if not AEAD wrapper. CBC chains blocks — padding oracle class when misused. ECB encrypts identical blocks to identical ciphertext — penguin pattern literacy. Cyberlium demos AES modes with openssl enc on YOUR $CRYPTO_LAB generated keys — never decrypt production captures without scope. Next: RSA Toy Named.
1. AES modes (named)
GCM: nonce + auth tag — default recommendation for new designs. CBC: IV required; padding errors enable oracle class — defender literacy only. CTR: counter mode stream — unique counter per message. ECB: avoid for structured data — identical blocks leak patterns.
On $CRYPTO_LAB, run openssl enc -aes-256-gcm demo on a file YOU wrote — note nonce and tag handling.
Command guide
Try these commands — AES modes (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL genrsa — https://www.openssl.org/docs/manmaster/man1/openssl-genrsa.html
NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final (2048-bit RSA minimum literacy) CWE-326 — https://cwe.mitre.org/data/definitions/326.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
openssl genrsa -out "$CRYPTO_LAB/keys/lab-toy-2048.pem" 2048
chmod 600 "$CRYPTO_LAB/keys/lab-toy-2048.pem"
openssl rsa -in "$CRYPTO_LAB/keys/lab-toy-2048.pem" -pubout -out "$CRYPTO_LAB/keys/lab-toy-2048.pub.pem"
grep -E 'private keys|never publish' "$CRYPTO_LAB/roe.txt"Primary tools to practice this lesson: openssl, grep. Reference sites: OpenSSL genrsa (https://www.openssl.org/docs/manmaster/man1/openssl-genrsa.html); NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); CWE-326 (https://cwe.mitre.org/data/definitions/326.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why mode literacy matters
Correct algorithm with wrong mode fails audits. Nonce reuse in GCM catastrophic — defender monitoring required. Library defaults (OpenSSL 3, libsodium) steer toward AEAD — students read docs before choosing CBC.
Incident reports cite mode misconfiguration — literacy supports remediation tickets.
3. Lab boundary
Forbidden: decrypting stranger AES blobs, ECB for real patient data because tutorial used it. Allowed: AES modes card — four modes, one-line risk/benefit, $CRYPTO_LAB openssl command sample.
Ship: AES modes card for YOUR lab demos. Next: RSA Toy Named.
4. What you ship: AES modes card for $CRYPTO_LAB
Four modes with risk notes. $CRYPTO_LAB openssl demo command. NO production ciphertext. chmod 600.
5. What you record before the next lesson
Date. AES modes card. $CRYPTO_LAB named. File t28-m05-l01-aes-modes-named.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use ECB for real database columns. Reuse GCM nonce because lab is small.
Right
Write AES modes card for YOUR $CRYPTO_LAB openssl demos. Next: RSA Toy Named.
Mission: demo AES-GCM on YOUR lab file
1) Name GCM, CBC, CTR, ECB in one line each. 2) Note GCM nonce uniqueness rule. 3) Record $CRYPTO_LAB openssl demo command. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Prefer -aes-256-gcm or libsodium crypto_aead — not bare CBC for new code.
Knowledge Check
APPLY: AES-GCM provides:
Multiple choice
Knowledge Check
APPLY: True or False: ECB mode leaks patterns when identical plaintext blocks repeat.
True or False
Knowledge Check
APPLY: AES modes literacy on Cyberlium uses:
Multiple choice