# Block ciphering

This chapter is dedicated to the block ciphering, a subpart of the standard security module.

## Block cipher

A block cipher is an object that encodes an input stream with a symmetric cipher bound to a unique key. Since a block cipher is symmetric, the data can be coded and later decoded to their original form. The difference with the `Cipher` base class is that the `BlockCipher` class provides a `get-block-size` method which returns the cipher block size.

### Block Cipher base

The `BlockCipher` class is a base class for the block cipher engine. The class implements the `stream` method that reads from an input stream and write into an output stream. The `BlockCipher` class is an abstract class and cannot be instantiated by itself. The object is actually created by using a cipher algorithm class such like the `Aes` class.

trans count (cipher:stream os is)

The `stream` method returns the number of characters that have been encoded. Care should be taken that most of the stream cipher operates by block and therefore, will block until a complete block has been read from the input stream, unless the end of stream is read. The block cipher is always associated with a padding scheme. By default, the NIST 800-38A recommendation is associated with the block cipher, but can be changed with the `set-padding-mode`.

### Creating a block cipher

A `BlockCipher` object can be created with a cipher constructor. As of today, the Advanced Encryption Standard or AES is the recommended symmetric cipher. The `Aes` class creates a new block cipher that conforms to the AES standard.

const cipher (afnix:sec:Aes)

A block cipher can be created with a key and eventually a reverse flag. With one argument, the block cipher key is associated with the cipher. Such key can be created as indicated in the previous section. The reverse flag is used to determine if the cipher operate in encoding or decoding mode. By default, the cipher operates in coding mode.

# create a 256 bits random key const key (afnix:sec:Key afnix:sec:KSYM 256) # create an aes block cipher const aes (afnix:sec:Aes key)

### Block cipher information

The `BlockCipher` class is derived from the `Cipher` class and contains several methods that provide information about the cipher. This include the cipher block size with the `get-block-size` method.

println (aes:get-block-size)

## Input cipher

In the presence of a `Cipher` object, it is difficult to read an input stream and encode the character of a block basis. Furthermore, the existence of various method for block padding makes the coding operation even more difficult. For this reason, the `InputCipher` class provides the necessary method to code or decode an input stream in various mode of operations.

### Input cipher mode

The `InputCipher` class is an input stream that binds an input stream with a cipher. The class acts like an input stream, read the character from the bounded input stream and encode or decode them from the bended cipher. The `InputCipher` defines several modes of operations. In electronic codebook mode or ECB, the character are encoded in a block basis. In cipher block chaining mode, the block are encoded by doing an XOR operation with the previous block. Other modes are also available such like cipher feedback mode and output feedback mode.

### Creating an input cipher

By default an input cipher is created with a cipher object. Eventually, an input stream and/or the input mode can be specified at the object construction.

# create a key const key (afnix:sec:Key "hello world") # create a direct cipher const aes (afnix:sec:Aes key) # create an input cipher const ic (afnix:sec:InputCipher aes)

In this example, the input cipher is created in ECB mode. The input stream is later associated with the `set-is` method.

### Input cipher operation

The `InputCipher` class operates with one or several input streams. The `set-is` method sets the input stream. Read operation can be made with the help of the `valid-p` predicate.

while (ic:valid-p) (os:write (ic:read))

Since the `InputCipher` operates like an input stream, the stream can be read as long as the `valid-p` predicate returns true. Note that the `InputCipher` manages automatically the padding operations with the mode associated with the block cipher.