is there a mode of AES which prevents partial decryption of
I claim to be no expert in cryptography, but my understanding of chain block cipher (CBC) is it has weaknesses primarily caused by lack of authentication. Although, because its initialisation vector (IV) is a fixed value (IV predicability), this IV outputs the last block of the ciphertext. You can view how different AES implementations conceal data about an image "Text partially decrypted regardless of IV".
"Decrypting with the incorrect IV causes the first block of plaintext to be corrupt but subsequent plaintext blocks will be correct. This is because each block is XORed with the ciphertext of the previous block, not the plaintext, so one does not need to decrypt the previous block before using it as the IV for the decryption of the current one." - Block cipher mode of operation
Galois/Counter Mode (GCM) is often thought of as GCM = CTR + authentication. AES-GCM with proper IV implementation is considered more secure than other AES alternatives. GCM is preferred because it's a faster algorithm and unlike CBC, GCM supports authentication. However, GCM "if you reuse a nonce. A single repeated nonce allows an adversary to recover its authentication subkey, plus to learn the XOR of the two messages with the same nonce." which is obviously not ideal. Also, GCM uses 96 bits IVs, making collision rates higher and IV reuse potentially more frequent.
This thread How to choose an AES encryption mode? should assist as it outlines different AES implementations, which should allow you to choose which is appropriate for your infrastructure.
Although, despite all this, I would opt for CBC for local storage. GCM has felt more for network (real time) encrypted communications.
Or anything else that slows down the process of testing lots of keys
I will presume by keys you refer to passwords. Where you want to pass the passwords through a one-way hashing function with multiple iterations (rounds) for storage by something (likely database).
Password hashing seems more important. I have read multiple disputes regarding using SHA-2 family for password hashing, most criticism comes from SHA-2 not performing multiple iterations, something you have already done, but this does not concern your scenario directly as you are using PBKDF2 with HMAC SHA512. However, I would review what type of system your potential attacker has, and implement a modern hashing algorithm to protect against that. E.g. do they use CPU, GPU or ASIC to brute force the PBKDF2. Argon2 has been known for good resistance against most brute forcing attempts. Comparing the three Argon2 algorithms:
- Argon2d: best protection against GPU brute force.
- Argon2i: optimised to resist side-channel attacks. It accesses the memory array in a password independent order.
- Argon2id: a hybrid of Argon2d and Argon2i.
All three modes allow specification by three parameters that control:
- execution time
- memory required
- degree of parallelism
These specifications should be considered for all password hashing algorithms. PBKDF2 is a known, and recognised hashing function which is considered to be secure for password hashing. However, it's recognised as being weak against an ASIC brute force.
I would choose between Argon2id or PBKDF2 HMAC SHA512, and evaluate depending upon which type of attacker I am defending against.