I'm using AES-256 CBC mode in C# to encrypt various amounts of texts. The key and IV are always generated properly randomly. However, would GCM mode provide any noticeable security gains over CBC?

  • GCM provides authenticity. CBC is malleable. Jun 22, 2018 at 14:16
  • What do you mean by "huge factor"? Jun 22, 2018 at 14:24
  • 1
    But what do you consider to be a huge factor? Malleability could be devastating in some cases, in others confidentiality is all that's required and authenticity is unneeded. Jun 22, 2018 at 14:41

1 Answer 1


It's a little hard to say without knowing your exact set-up, but CBC may well be fine, especially as it is available in .NET as is.

The main risk of CBC is the padding oracle attack here are some good links:



If you can be confident that an attacker cannot modify the cipher text then you should be alright. You could also go down the route of encrypt-then-MAC to ensure that the actual ciphertext was unaltered.

  • Padding is a requirement of a block cipher unless your plaintext size is fixed and equal to the cipher block size. You may not realize your are even using it if your implementation chooses a default value
    – ste-fu
    Jun 22, 2018 at 19:51
  • I believe encrypt then MAC is considered generally safe, but it's hard to speak in absolutes
    – ste-fu
    Jun 23, 2018 at 18:29
  • In .Net? Didn't know there was an implementation
    – ste-fu
    Jun 24, 2018 at 6:27
  • Good point for you to use random IV. It is important also to ensure the use of random padding
    – lalebarde
    Feb 8, 2019 at 16:27

You must log in to answer this question.