Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
Block vs stream, the seven modes of operation an examiner must know, DES through Triple-DES, AES internals (SubBytes, ShiftRows, MixColumns, AddRoundKey), why RC4 is dead, Blowfish and Twofish, ChaCha20-Poly1305, and how Aadhaar, UPI and the RBI 2023 PoS mandate map onto AES-256.
Every byte of bulk-encrypted data an Indian forensic examiner deals with passes through a symmetric cipher. WhatsApp's message database, Aadhaar's UIDAI authentication payloads, UPI's pay leg, BitLocker volumes seized in cybercrime raids, and ransomware-encrypted hospital records all use AES under the hood. Understanding which symmetric cipher, in which mode, with what IV handling, with what key derivation, with what authentication, decides whether the report will hold up under cross-examination or fall apart on the second question from the defence.
This topic covers the symmetric half of the digital forensics cryptography block: the block-versus-stream split, the seven modes of operation (ECB, CBC, CTR, GCM, XTS, plus OFB and CFB for completeness), the DES family from its 1977 publication to Triple-DES's 2023 NIST deprecation, AES internals through the SubBytes/ShiftRows/MixColumns/AddRoundKey round structure, why RC4 was buried in 2015, Blowfish and its successor Twofish, ChaCha20-Poly1305 as the modern mobile-friendly alternative, and the strength-comparison arithmetic that makes AES-256 the default for Indian regulated systems. It assumes the vocabulary from Cryptography Fundamentals: Symmetric vs Asymmetric, Substitution and Transposition. The companion topic on Asymmetric Cryptosystems, Hashing, PKI and Digital Signatures covers the other half, and the attack catalogue in Cryptanalysis, Cryptographic Attacks and Diffie-Hellman closes the loop on the breaks that target the modes and key-management layers below.
Two structural families. Pick by data shape, not by intuition.
A symmetric cipher is one of two structural families. Both can be made arbitrarily secure with the right design; they differ in how they handle data shape.
A block cipher operates on a fixed-size block of plaintext, typically 64 bits (DES, Blowfish, 3DES) or 128 bits (AES, Twofish, Camellia, ARIA). Encrypt and decrypt are bijections on the block space, parametrised by the key. Messages longer than one block need a mode of operation that defines how to split, chain or otherwise process the data. Messages shorter than one block need padding (PKCS#7 is the standard) or a streaming mode that avoids padding entirely.
A stream cipher produces a pseudo-random keystream from the key (and usually a nonce). Plaintext is XORed with the keystream byte-by-byte or bit-by-bit. There is no block alignment, no padding, and the same key with two different nonces produces independent ciphertexts. RC4 is the historical example; ChaCha20 and Salsa20 are the current ones. Block ciphers in CTR or OFB mode behave as stream ciphers, which is why "stream cipher" today often means "any cipher used in a streaming way."
| Property | Block cipher (raw) | Stream cipher |
|---|---|---|
| Granularity | Fixed block (64 or 128 bits) | Bit or byte |
| Padding | Required for non-block-aligned input | Not required |
| State | Stateless (key only) | Stateful keystream (key + nonce + position) |
The block cipher is the engine. The mode is the protocol. Most failures live in the mode, not the engine.
A block cipher on its own encrypts 16 bytes at a time. Real messages are longer. The mode of operation defines what happens between the blocks.
The 1977 standard. Broken by 1998. Triple-DES bought 25 years; NIST retired it in 2023.
The Data Encryption Standard (DES) was published as FIPS 46 in 1977, the first cipher to be openly standardised by the US National Bureau of Standards (now NIST) for non-military use. It defined the symmetric-encryption landscape for two decades.
Structural facts an examiner needs:
DES's fate was sealed by Moore's law. The EFF DES Cracker ("Deep Crack"), built in 1998 for under $250,000, brute-forced a DES key in 56 hours; a follow-up effort with distributed.net got it to 22 hours. By 2010 a moderate cluster could do it in minutes. DES is dead.
Triple-DES (3DES, TDEA) keeps the DES engine but applies it three times with three different 56-bit keys: ciphertext = E_k3(D_k2(E_k1(plaintext))). The encrypt-decrypt-encrypt structure preserves backward compatibility (set k1 = k2 = k3 and you have plain DES). The effective key length is 112 bits, not 168, because of the meet-in-the-middle attack that lets an attacker trade memory for time and break two-key-equivalent constructions in roughly 2^112 work. 3DES survived in legacy banking systems through the 2010s. NIST SP 800-131A formally deprecated 3DES after December 2023; it is now forbidden for new federal cryptographic deployments. Indian banks running legacy PIN-block protection have been migrating to AES under RBI guidance since 2020.
The 2001 winner. 25 years of attack and still standing. The default for everything that matters.
The Advanced Encryption Standard (AES) was published as FIPS 197 in November 2001, capping a four-year open NIST competition (1997 to 2000) that received 15 submissions, narrowed to 5 finalists (MARS, RC6, Rijndael, Serpent, Twofish) and selected Rijndael by Belgian cryptographers Joan Daemen and Vincent Rijmen.
AES's structural facts:
The four operations, in detail:
| Operation | What it does | What property it provides |
|---|---|---|
| SubBytes | Replaces each byte in the 4x4 state matrix via a fixed 8-bit S-box (multiplicative inverse in GF(2^8) followed by an affine transform) | Nonlinearity (confusion) |
| ShiftRows | Cyclically shifts row i of the state by i positions to the left | Inter-column diffusion |
| MixColumns |
One dead, one retired but still in bcrypt, several still around for legacy reasons.
RC4 (Rivest Cipher 4, 1987). A stream cipher designed by Ron Rivest at RSA Security. Internally it maintains a 256-byte state permutation S and two indices i and j. The Key Scheduling Algorithm (KSA) seeds S from the key; the Pseudo-Random Generation Algorithm (PRGA) outputs one keystream byte per step. Variable-length key from 40 to 2048 bits. RC4's selling points were speed (the simplest stream cipher to implement) and minimal memory footprint. It powered SSL 3.0 / TLS 1.0 / TLS 1.1 web traffic, WEP, WPA-TKIP and countless proprietary protocols.
RC4's death was slow but inevitable:
RC4 is dead. The only encounter an examiner has with RC4 in 2026 is on legacy hardware (very old Cisco gear, ancient Windows DC traffic, MS Office 97-2003 password protection on .doc files), in malware that uses RC4 as a configuration-decryption layer, and in WEP-secured IoT devices that should be replaced.
Blowfish (Bruce Schneier, 1993). A 64-bit block, Feistel-style cipher with 16 rounds and a variable key length of 32 to 448 bits. Public domain (unpatented and free for any use), which made it the symmetric cipher of choice for open-source projects in the 1990s. It is fast on 32-bit CPUs but the 64-bit block makes it vulnerable to Sweet32 birthday attacks for long sessions (after roughly 32 GB on one key, ciphertext collisions become probable, leaking plaintext via XOR). Blowfish is not recommended for new bulk-encryption applications.
The one place Blowfish survives in mainstream production is bcrypt, the password-hashing function based on a deliberately expensive Blowfish key schedule. Niels Provos and David Mazieres designed bcrypt in 1999; it is still the default password hash in PostgreSQL, OpenBSD, and many Rails / Laravel / Django stacks. bcrypt's strength is the tunable cost factor (work parameter from 4 to 31), which lets defenders make password cracking deliberately slow.
Twofish (1998). Schneier's successor to Blowfish, an AES finalist with a 128-bit block and 128/192/256-bit keys. Lost to Rijndael in the AES competition but is still used in some VeraCrypt installations (selectable as an alternative cipher) and in older PGP versions. No serious cryptanalytic break is known.
AES-256 at the top, 3DES retired, RC4 dead. The numbers behind the recommendation.
The strength of a symmetric cipher is dominated by its key length and by any known attack that reduces the effective key length below the brute-force bound.
| Cipher | Key length | Brute-force bound | Effective security | 2026 status |
|---|---|---|---|---|
| DES | 56 bits | 2^56 | 2^56 (broken in 22 hours by 1998 EFF cracker) | Forbidden |
| 3DES (3-key) | 168 bits stored | 2^168 | 2^112 due to meet-in-the-middle | NIST deprecated post-2023 |
| Blowfish | 32 to 448 bits | 2^N for N-bit key | Practically 2^N; Sweet32 limits sessions to ~32 GB | Not recommended for new bulk encryption |
| AES-128 | 128 bits | 2^128 |
A captured ciphertext file is exactly 1,048,592 bytes long (1 MB plus 16 bytes). The plaintext is suspected to be a Word document. Which mode of operation is most consistent with this size profile?
| Random access | Easy (each block independent in ECB; per-counter in CTR) | Trivial in CTR-built streams; harder in classical Vernam-style RC4 |
| Bit-flip propagation | One block in CBC; localised in CTR | Per-bit (one ciphertext bit flip = one plaintext bit flip without MAC) |
| Examples | DES, 3DES, AES, Blowfish, Twofish | RC4 (dead), ChaCha20, Salsa20 |
The practical implication for examiners: a captured ciphertext file's length tells you a lot. A file whose size is an exact multiple of 16 bytes plus 16 (one IV plus PKCS#7 padded blocks) is almost certainly AES-CBC. A file whose size is "any length" with no obvious alignment is either CTR-mode, GCM (with a 12-byte nonce prefix and 16-byte tag suffix), or a true stream cipher. The size shape is the first diagnostic before any byte-level analysis.
| Multiplies each column of the state by a fixed 4x4 matrix in GF(2^8) |
| Intra-column diffusion |
| AddRoundKey | XORs the state with a 128-bit round key derived from the master key via the key schedule | Key mixing |
AES-NI (AES New Instructions) is Intel's hardware acceleration introduced in the Westmere microarchitecture in 2010 and matched by AMD's Bulldozer in 2011. The instructions (AESENC, AESENCLAST, AESDEC, AESDECLAST, AESKEYGENASSIST) compute one full AES round per instruction in 4 to 8 CPU cycles. The performance jump from software AES (T-table based, around 16 cycles per byte) to AES-NI (under 1 cycle per byte) was about 20x, and crucially AES-NI is constant-time by construction, which closed the door on the cache-timing attacks (Bernstein 2005, Osvik et al 2006) that had plagued software AES.
AES-256 vs AES-128. Both are believed secure against all known attacks. AES-128 has 2^128 brute-force complexity (out of reach for any classical attacker in 2026). AES-256 has 2^256, well beyond brute force even under aggressive Grover-algorithm speedups in a future cryptographically-relevant quantum computer (which would halve the effective key length to 128 bits, still secure). Indian government and Aadhaar-tier systems mandate AES-256 across the board on the principle of long-life data confidentiality.
Other named symmetric ciphers an examiner might meet:
ChaCha20-Poly1305 (Bernstein 2008, RFC 8439). A modern stream cipher (Salsa20 family) plus the Poly1305 MAC, packaged as an AEAD. The TLS 1.3 alternative cipher suite TLS_CHACHA20_POLY1305_SHA256 was designed specifically for devices without AES-NI hardware: phones, embedded systems and older servers. On AES-NI-equipped hardware, AES-128-GCM and ChaCha20-Poly1305 are roughly equal in throughput. On non-AES-NI hardware (most Android phones through 2018, embedded ARM, IoT), ChaCha20 is several times faster in software and was Google's reason for adding it as a TLS option in 2014.
| 2^128 (best known attack: biclique at 2^126.1, marginal) |
| Recommended, FIPS 140-3 approved |
| AES-256 | 256 bits | 2^256 | 2^256 classically; 2^128 under Grover quantum speedup (still safe) | Recommended for long-life data |
| RC4 | 40 to 2048 bits | Variable | Practically 2^48 to 2^64 due to keystream biases | Forbidden (RFC 7465) |
| ChaCha20 | 256 bits | 2^256 | 2^256 (no known reduction) | Recommended; TLS 1.3 standard |
Hardware vs software implementations. Three layers an examiner needs to distinguish:
Constant-time crypto is the defensive design principle that the execution time, memory-access pattern and power profile of an implementation must not depend on the secret key or the plaintext. The motivating attacks are timing leaks (Kocher 1996 against RSA, Bernstein 2005 against AES T-tables), cache-side-channel attacks (Flush+Reload, Prime+Probe), and power-analysis attacks against smartcards. AES-NI is constant-time by hardware design; ChaCha20 in C is naturally constant-time because it has no data-dependent branches or table lookups. Pure-software AES is harder to make constant-time and bitsliced implementations are the modern answer.
The Indian regulated stack binds these choices to real infrastructure:
A forensic report on Indian regulated-system evidence should name the cipher (AES-256), the mode (GCM, CBC with HMAC, CTR for token streams, XTS for full-volume), the key length (128 or 256), the IV/nonce handling, and the implementation layer (AES-NI, HSM, software). All five details are required for a defensible chain-of-custody narrative; cross-link Asymmetric Cryptosystems, Hashing, PKI and Digital Signatures for the signature side of the same chain.