This is a good overview, worth reading. I have some nits.<p>* This isn&#x27;t a legit criticism of the article, but: it drives me nuts when people suggest the big problem with ECB is that you can see penguins through it. The reason ECB penguins are see-through is that ECB isn&#x27;t semantically secure. The bigger problem with this trait is that you can usually <i>decrypt ECB altogether without a key!</i>. A really thorough understanding of how ECB breaks down is hugely helpful to understanding the TLS flaws. Enough with the penguins!<p><a href="http:&#x2F;&#x2F;cryptopals.com&#x2F;sets&#x2F;2&#x2F;challenges&#x2F;12&#x2F;" rel="nofollow">http:&#x2F;&#x2F;cryptopals.com&#x2F;sets&#x2F;2&#x2F;challenges&#x2F;12&#x2F;</a><p>* Timing-driven padding oracles predate Lucky 13; the person who more or less taught me crypto told me about them back in 2009. Again, not a super legit criticism of the article, but worth knowing.<p>* There are other error side channel attacks besides padding oracles, and some of them affect modes other than CBC.<p>* CBC mode is in decline, but the article is kind of incoherent about why, or whether that&#x27;s a good thing. &quot;CBC is OK for static content&quot; is a recommendation that doesn&#x27;t make any sense to me at all. CTR and derivatives will eat CBC entirely over the long run: CTR is simpler than CBC (it has minimal format constraints), only requires the encryption transform, and is marginally easier to implement faster.<p>* What&#x27;s really in decline is generic composition cryptosystems, where encryption and authentication are specified independently. Most of the last 10 years of TLS bugs stem from TLS being specified before the industry understood the central role of authentication in secure cryptosystems. For a good example of this, look at POODLE, which is an attack made possible by an idiosyncratic CBC that uses nondeterministic padding that can&#x27;t be reliably authenticated.