# Can ECB mode really leak some characters?

In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph

The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That was a poor choice on the part of Adobe engineers, because ECB often leaks information about the passwords, such as their last few characters and some of their lengths. In certain cases, for example, passwords that end in e will generate an encrypted string that ends in n2auThm2+Q==; those that are nine or 17 characters long will sometimes end in mfZq5OGbb5.

Is it really the case?

-
Sigh. I really wish whoever it was that introduced the word 'entropy' to journalists wouldn't have. It gets my vote for the most overused cryptography-related word by laymen, hands down. Case-in-point: the article says attackers can "reduce the entropy" using a meet-in-the-middle attack? (???) –  Reid Nov 2 '13 at 19:37
@Reid What the fuck. –  nightcracker Nov 3 '13 at 1:10
I find myself wondering more why they've got an encryption of the password rather than a hash. –  figlesquidge Nov 3 '13 at 10:25

The article mentions that 3-DES was used to encrypt these passwords in ECB mode. DES has a 64-bit/8-byte block.

So let's say you use ECB to encrypt a nine byte password. The first 8-bytes are encrypted using ECB. So far so good.

But what happens when we come to the ninth byte? Well we're now in a new block but only the first byte is populated with any data. The rest are zeros (assuming no padding is used).

This means that there are only 256 possible encryptions of the second block for all nine byte passwords. With a large enough database, it will be relatively easy to guess what these encryptions are. If you had a dictionary of common nine character passwords, a mere frequency analysis of the last character of the password and a comparison to the frequency of the second ECB blocks would be enough!

So yes, the paragraph is correct. It's a significant hole in the scheme they used.

-
It does not matter what padding mode is used, as long as it is deterministic. –  owlstead Nov 3 '13 at 13:55