Also known as: block cipher
A block cipher encrypts data in fixed-size blocks — for example 128 bits in AES or 64 bits in DES — transforming each block under a key with a keyed, invertible permutation.1 A mode of operation then chains the blocks so the cipher can handle messages of any length. Because encryption and decryption use the same secret key, a block cipher is a symmetric primitive and the building block behind most modern data encryption.
How it works
The core block cipher is a single keyed permutation: for a fixed key it maps every possible input block to a distinct output block, and the mapping is invertible so the holder of the key can reverse it. A block of n bits has 2ⁿ possible values, and the key selects one particular reordering of that enormous set — far too many to tabulate, so the permutation is computed on the fly from many simple rounds.
Two design goals, named by Claude Shannon, drive every round:
- Confusion makes the relationship between key and ciphertext as complex as possible, supplied by nonlinear S-box substitution.
- Diffusion spreads the influence of each plaintext bit across the whole block, supplied by permutation and mixing so that changing one input bit flips about half the output bits (the avalanche effect).
Two structural families realize this. A Feistel network (DES) splits the block in two and mixes one half into the other through a round function that need not itself be invertible. A substitution-permutation network (AES) transforms the whole block each round with invertible substitution and permutation layers. Both repeat many keyed rounds so the output depends intricately on every input and key bit.
Variants — modes of operation
Because real messages are longer than one block, a mode of operation specifies how successive blocks combine.2 The mode, not the cipher, determines the security of the message as a whole:
- ECB (Electronic Codebook) encrypts each block independently — simple but insecure, since identical plaintext blocks yield identical ciphertext blocks and leak structure (the classic “ECB penguin”).
- CBC (Cipher Block Chaining) XORs each plaintext block with the previous ciphertext block before encrypting, so identical plaintext no longer maps to identical ciphertext; it needs a random initialization vector and is inherently sequential.
- CTR (Counter) and OFB (Output Feedback) do not encrypt the plaintext at all — they encrypt a counter or a feedback register to generate a keystream, then XOR it with the data, turning the block cipher into a stream cipher. These need only the forward direction of the cipher and demand a never-repeating nonce.
In practice
Block size and key size matter independently. DES’s 64-bit block and 56-bit key are both too small today — the key falls to brute force and the small block invites birthday-bound collisions on long streams — which is why AES moved to a 128-bit block and 128/192/256-bit keys. In real protocols the raw block cipher is almost never used alone: it is wrapped in a mode (often CTR or an authenticated mode like GCM) that supplies the length handling and, increasingly, integrity as well.
Relevance to SDR
Block ciphers underpin the strong encryption on the digital systems GopherTrunk monitors. P25 voice may use DES or AES-256, and DMR encryption options likewise build on AES — but these protocols run the block cipher in a feedback mode (OFB/CTR), so on air the protected voice is delivered as a stream cipher over the vocoder frames. The practical upshot is the same: GopherTrunk can recognize and follow an encrypted call but cannot recover audio without the key, since the underlying permutation is infeasible to invert by brute force.
Sources
-
Block cipher — Wikipedia, for fixed-size block encryption, confusion/diffusion, and the Feistel vs SPN structures. ↩
-
SP 800-38A, Recommendation for Block Cipher Modes of Operation — NIST, for the ECB, CBC, CFB, OFB, and CTR modes of operation. ↩