CEH Cryptography and Malware Analysis Practice Question

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

⚠ Common exam trap

The trap here is that candidates often forget that ECB does not use an IV or authentication tag, so they incorrectly assume all block cipher modes add overhead, leading them to choose CBC or GCM despite the length constraint.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

ECB

ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
GCM
Why it's wrong here
Galois/Counter Mode (GCM) is an authenticated encryption mode that combines confidentiality with data integrity and authenticity. While it uses a counter mode for encryption, its defining feature is the generation and appending of an authentication tag to the ciphertext. This tag, crucial for verifying data integrity and authenticity, inherently increases the overall length of the transmitted data beyond just the padded plaintext, making it unsuitable when minimal length increase is the primary concern.
✗
CFB
Why it's wrong here
Cipher Feedback (CFB) mode operates as a stream cipher, generating a keystream that is XORed with the plaintext. While it can produce ciphertext of the same length as the plaintext, it requires a unique Initialization Vector (IV) for each encryption operation to ensure semantic security and prevent identical plaintexts from yielding identical ciphertexts. This IV, though not part of the ciphertext blocks themselves, is an essential additional piece of data that must be transmitted or derived, contributing to the overall data overhead.
✓
ECB
Why this is correct
Electronic Codebook (ECB) mode encrypts each fixed-size block of plaintext independently using the same secret key. It does not employ any chaining mechanism between blocks, nor does it require an Initialization Vector (IV) or nonce. The only potential increase in data length results from padding the final plaintext block to meet the cipher's block size, making it the mode that introduces the absolute minimum cryptographic overhead and data expansion.
✗
CBC
Why it's wrong here
Cipher Block Chaining (CBC) mode enhances security by XORing each plaintext block with the previous ciphertext block before encryption, creating a dependency chain. For the first block, and to ensure unique ciphertexts for identical plaintexts, CBC mode mandates the use of a unique Initialization Vector (IV). This IV is a critical component for decryption and is typically transmitted alongside the ciphertext, thereby adding to the total data length beyond the encrypted blocks themselves.

Quick reference

Symmetric Encryption Algorithm Comparison

Algorithm	Key Size	Block Size	Status	Notes
AES-128	128-bit	128-bit	Current standard	NIST approved; WPA3, TLS
AES-256	256-bit	128-bit	Current standard	Preferred for sensitive / govt data
3DES	112-bit effective	64-bit	Deprecated (2023)	Replaced by AES
DES	56-bit	64-bit	Broken	Cracked in < 24 h; never deploy
ChaCha20	256-bit	Stream cipher	Current	TLS 1.3, WireGuard

Go deeper

CEH Cryptography and Malware Analysis Practice Question

Why each option matters

Option-by-option breakdown

Symmetric Encryption Algorithm Comparison

Related to this question