How to figure out DES mode used given plaintext and ciphertext? In DES, I'm given the following exercise. 


  
  - How can I find out which part of the plaintext each ciphertext message corresponds to, and which mode they were each encrypted with?
Let's assume that we're talking about the following classic modes for block ciphers (although there are certainly more): ECB, CBC, CFB, OFB and CTR.



First of all the second message is way too long to fit into the ciphertext, so we can safely discard that possibility.



Then we can look at the size of the plaintext and ciphertext. The plaintext message is 14 character, which are generally encoded to 14 bytes. The size of the three ciphertext are 14, 16 and 14 bytes.

Now ECB and CBC are generally using padding, so that the padded plaintext and the ciphertext are Y times the block size. The other modes are streaming modes so they don't require padding, and the size of the messages are identical to the plaintext size.

So with that in mind, ciphertext one is using streaming (CFB, OFB or CTR), ciphertext two is using ECB or CBC and ciphertext 3 is using streaming again.



Can we find out more? Sure, message 1 and 3 are clearly starting with the same ciphertext.  Now for CTR only the first half of the IV was used, so it is less likely that will correspond with either of the two ciphertext. That would only be the case if the second half of the IV was set to all zeros (the initial counter value is identical to the IV) for the other modes.

That leaves CFB and OFB, and if we look at those schemes we see that the calculation of the first ciphertext is exactly identical to each other. Only after that there are differences, because one uses ciphertext feedback, while the other uses output feedback.



Can we say much more? I don't think so. We lack any information to distinguish ECB from CBC or CFB from OFB (other than knowing that if one ciphertext uses one, the other one must have been generated using the other).

If there are ways of using the blocks of one cipher to determine the precise mode of another then I don't see it. OFB and CFB start with encrypting the IV, and CTR and CBC don't do that.

Once the calculations end up with a different input to the block cipher and are permuted, we cannot learn anything from them unless we know the permutation - i.e. the key. We can just tell the blocks apart.