A fixed key selects a permutation
For a fixed key, a block cipher maps each b-bit input to a b-bit output with a corresponding inverse. Distinct complete input blocks under that key therefore have distinct outputs, unlike a hash compressing a larger domain into a digest.
Block width describes one transformation’s data size, while key width describes its secret parameter. They can differ: all three AES key lengths use 128-bit blocks, so a longer key does not directly hold more plaintext per operation.
Modes organize the primitive into message processing
Modes define how the primitive and extra state process a message. ECB treats blocks independently; CTR transforms distinct counter inputs and XORs the resulting stream with data. Modes alter pattern leakage, parallelism and initialization conditions.
Decryption need not always invoke the primitive’s inverse function. CTR uses the forward transformation on both sides to generate the stream, then XORs it with plaintext or ciphertext. The inverse primitive and a mode’s decryption process are different concepts.
References: [2]
Padding and authentication depend on the mode
Some modes need complete blocks and a defined way to handle a short final portion; CTR can process a partial final block as specified. Not every block-cipher application therefore requires the same padding, and initialization or counter rules remain mode-specific.
A confidentiality mode does not automatically authenticate a message. Rejecting unauthorized changes requires a suitable authentication or AEAD construction, including failure handling and context binding. A sound primitive and a complete secure protocol are different layers.