[JoachimSchipper]

ECB, I think? The focus was definitely on attacking the crypto core per se.

(Of course, ECB is almost certainly a bad idea if you're trying to build an actual application!)

[cramsay]

Yes, ECB, although other modes would only require superficial changes. In practice the harder task is actually identifying the mode in use!