The Root Of Trust
All posts

Encryption modes, ranked, and why payments care

September 2026 · 5 minute read

Most people think encryption is one decision. Pick AES, done. It isn't. AES is the lock. The mode is how you use the lock. Same lock, same key, and you can still leave the door open.

Encryption modes ranked weakest to strongest Five modes ranked: ECB, CBC, CFB/OFB, CTR, GCM. Encrypting the input A A B A, only ECB repeats its output pattern. GCM adds a tamper tag. Reusing a nonce undoes the ranking. Encryption modes, ranked weakest to strongest Same key. Same message. Very different secrets. Mode Input A A B A becomes Strength 1 ECB Same input, same output 2 CBC Each block leans on the last 3 CFB / OFB Block cipher acting as a stream 4 CTR Numbered pad, runs in parallel 5 GCM Encrypts it and seals it shut tag Reuse the IV or nonce and the ranking collapses. @therootoftrust
The same four input blocks, encrypted five ways. Only ECB gives away that blocks one, two and four were identical.

The ranking, weakest to strongest

  1. ECB. Every block is encrypted on its own. Same input, same output, every time. Encrypt a picture with it and you can still see the picture.
  2. CBC. Each block gets mixed with the one before it, so repeats vanish. It needs a fresh random IV. It hides your data, but it can't tell you if someone changed it.
  3. CFB / OFB. Uses the cipher to make a stream of random-looking "pad" that gets mixed into your data. Solid, just less common today.
  4. CTR. Encrypts a simple counter to make that pad. Fast, parallel, no padding. Still no tamper check.
  5. GCM. CTR plus a seal. Change one bit and decryption refuses to work. This is the default for new designs.

Honest note: numbers 2, 3 and 4 are close. The big jumps are ECB to everything else, and "hides the data" to "hides the data and proves nobody touched it."

Where this shows up in payments

This is the part you won't see in most posts.

ECB isn't a crime everywhere

A PIN block is exactly one block. No second block, no pattern to leak. The real problem was elsewhere: in ISO format 0, the same PIN on the same card always produced the same encrypted block. ISO format 4 fixed that with random fill, and it runs AES twice with the PAN mixed in between. That's a hand-built chaining mode made just for a PIN.

Your key check value is ECB

The check value you read out during a key ceremony? For classic TDES keys, that's literally ECB. Encrypt a block of zeros, keep a few digits. The "weakest" mode, doing an honest job as a fingerprint.

TR-31 uses the MAC as the IV

TR-31 version D key blocks compute the MAC first, then use that MAC as the IV for CBC. The IV isn't random, yet it only repeats if the whole key block is identical. Safe by design, not by luck.

DUKPT and the all-zero IV

A lot of DUKPT data encryption runs CBC with an all-zero IV. It holds up because the key changes every transaction. Freeze that key and the first block quietly behaves like ECB.

The one that stings

GCM with a reused nonce is worse than ECB. ECB leaks patterns. Reused-nonce GCM leaks the relationship between two messages and lets an attacker forge the seal. Rank 5 becomes rank 0 because of one lazy counter.

The ranking is real, but it comes with a condition. A mode is only as strong as the IV discipline behind it.

Next time someone says "we use AES," ask which mode, and where the IV comes from.