Question

I have two questions regarding the Block Cipher Modes:

Which one of the modes is considered the best?
I know CBC has a problem of IV since the next block of the plain text is XORed with the result of cipher text of the last block and the same with OFB. Is CTR the best one or not?

In "SSL with blockciphers in CBC-mode", does TLS 1.2 use CBC or is there any other modes that is used with TLS 1.2 (SSL 3.0)?

Answer 1

There is no "best" mode of operation, just modes more or less useful in different situations.

CBC-mode requires an initialization vector which is unpredictable by the adversary (preferably random), especially if this adversary can mount a chosen plaintext attack. Up to TLS 1.0 (i.e. also in SSL 2.0 and 3.0), CBC was used with a "use last block of previous message as IV", and this is obviously not unpredictable if there is some time between the messages. TLS 1.1 fixes this by using a random per-message IV.

This problem can be avoided by implementations (without violating the protocol) by sending an empty message (which still gets padded to at least a full block) directly before any real message (i.e. after the application decided the content of the real message), and this is what OpenSSL does for quite some time. (It helps only on the sending side, not the receiving one, though.)

CTR mode requires that the initialization vector is non-repeating for all uses of the same key, as identical IVs give an identical key stream (which is then XORed with the message) - the same is valid for OFB mode.