There is a bug in CommonCrypto where block ciphers do not raise kCCAlignmentError when finalizing if you supply non-block aligned data. To work around this we need to keep track of the block alignment ourselves, but only for alg+mode combos that require block alignment. OFB, CFB, and CTR make a block cipher algorithm into a stream cipher so we don't need to track them (and thus their block size is effectively 1 byte just like OpenSSL/CommonCrypto treat RC4 and other stream cipher block sizes).