Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ?

  1. AES-ECB($key$ , $msg$)
  2. SIV($key$, NIL , $msg$) where associated data is NIL.

I could not make out much from Rogaway and Shrimpton's paper on "Deterministic Authenticated Encryption" which introduces Synthentic IV (SIV) mode.

Edit: Here $msg$ is same as single block .

share|improve this question
SIV. As long as an adversary never submits exactly the same message the ciphertext remains indistinguishable from random bits – figlesquidge Feb 19 '14 at 12:57
No, in ECB mode submitting the same block will leak information - rather than SIV where the entire message must be the same to leak information – figlesquidge Feb 19 '14 at 13:18
For a single block, ECB is perfectly fine. – CodesInChaos Feb 19 '14 at 15:40
Imagine some data type that is 128 bits like say IPv6 address and for some reason i want to encrypt it deterministically. – sashank Feb 19 '14 at 16:32
@pg1989 : $\:$ No; SIV also provides authentication. $\;\;\;\;$ – Ricky Demer Dec 22 '14 at 19:24

1 Answer 1


  • Secure deterministic encryption for one-block messages.


  • No expansion for block-sized messages.
  • Faster.


  • Authentication.
  • Works for messages of any size.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.