Cipher modes operate on the next level up from the underlying block
cipher. They transform the blocks going in and out of the cipher in ways
to give them desirable properties in certain circumstances. The cipher
modes implemented by GNU Crypto, which is contained in the
`gnu.crypto.mode`

package and are referenced herein by their
three-letter abbreviations described below, are:

**Cipher block chaining mode**. The "CBC" mode makes every block of the ciphertext depend upon all previous blocks by adding*feedback*to the transformation. This is done by XORing the plaintext with the previous ciphertext (or, with the first block, an initialization vector) before it is transformed. That is, encryption looks like: C[i] = ENCRYPT(k, P_i ^ C[i-1]); and decryption is P[i] = C[i-1] ^ DECRYPT(C[i]).**Counter mode**. Counter mode, referred to as "CTR" mode, is one of a class of sequenced cipher modes that turn the underlying cipher into a*keystream*. Counter mode relys on a simple counter register that is updated for every block processed. For plaintexts P[1] ... P[n], ciphertexts C[1] ... C[n], counter elements T[1] ... T[n], and an encryption function ENCRYPT(k, ...), encryption is defined as C[i] = P[i] ^ ENCRYPT(k, T[i]) and decryption as P[i] = C[i] ^ ENCRYPT(k, T[i]).**Electronic codebook mode**. Or "ECB" mode, is the most obvious cipher mode: the cipher block is the direct output of the forward function, and the plain block is the direct output of the inverse function. That is, encryption is C_i = E_k(P_i) and decryption is P_i = E_k^\bgroup-1\egroup(C_i).**Integer counter mode**. "ICM" mode has features in common with counter mode described above. The counter, T_i, is computed by T_i = (T_0 + i) \bmod 256^b, where b is the cipher's block size. T_0 is initialized to the integer representation of some initialization vector. The keystream bytes are then E_k(T_i). Encryption and decryption are then C_i = P_i \oplus E_k(T_i) and P_i = C_i \oplus E_k(T_i), respectively.**Output feeback mode**. "OFB" mode creates a keystream by repeatedly iterating the underlying block cipher over an initialization vector. That is, the ith keystream block is X_i = E(X_\bgroup i-1\egroup) for 1 < i \leq n, and X_1 = IV. Like the other stream modes, the input block i is transformed by the exclusive-or of the block with X_i.