What encryption mode should I use to protect CAN bus communication? I have a CAN bus project and I should encrypt the communication between nodes using the AES algorithm. Which encryption mode should I use?
Theory aside, there's basically no way to have security on the CAN bus.
The Controller Area Network, or CAN bus, is a differential bus that is robust enough for critical communications but simple enough to be used with micro-controllers. CAN bus employs a message-based protocol over four wires, power, ground, CAN-, and CAN+, where the message from a device with the lowest ID becomes dominant on the bus.  In the language of the CAN specification, the “dominate” bit is “0” and “recessive” bit is “1” based on the fact the signal lines are drive to their high and low states by transistors in the dominate state and that resistors passively pull the signal lines to each other in a passive fashion in the recessive state. Relating to physical security of this bus, if you &quot;short&quot; two lines, it will cease to function.
CAN data frame starts with an arbitration field that contains the ID of the node. If two nodes have a message at the same time, both nodes will start transmission concurrently, and the node with the higher ID number in binary will stop transmitting when it sets the bus to be recessive, which is a “1”, but detects that the bus is in a dominate state, which is a “0”. At this point, a collision has happened and the node has lost arbitration. This is also the physical reason that it is impossible to physically protect the CAN bus from a malicious device on the bus, because setting the bus to “0” that forces the bus into the dominate state is an attack on availability, such as a DoS attack. The best that the system can do in this case is to detect the fault and shut down.

Security for CAN bus through authentication protocols for CAN bus proves difficult because authentication codes are not tied to message IDs, which makes them impossible to trace, and do not generally seem appropriate for implementations on simple microcontrollers. Although authentication is required and is an important problem, you will have to focus only on encryption of the data in the CAN frame because of its importance from the hardware implementation perspective.
You cannot use a counter because you cannot guarantee delivery of a packet.  You are pretty much stuck with ECB mode for encryption.