Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication?

Assume A wants to transmit an authenticated message X to B. A and B have a shared key. What if A encrypts the plaintext X using AES-ECB and outputs Y as the ciphertext and appends it next to the plaintext X as a MAC? Would that be secure?

Confidentiality is not of importance here. We only need to authenticate the data.

share|improve this question
What is "Y" here? The ciphertext? – Thomas Sep 3 '14 at 15:03
Yes. Let me edit it to make it more clear – BlaX Sep 3 '14 at 15:04
Similar question on Information Security (not with ECB, but with a slightly more complex mode that exhibits a similar problem) – Gilles Sep 3 '14 at 15:19
up vote 9 down vote accepted

It is not secure, because an attacker can "mix and match" the output blocks from different authentication tags on different input messages, or repeat output blocks for repeated input blocks.

For example, if the attacker knows the tag $F_k(m)$ for a one-block message $m$, then it can forge the correct tag $F_k(m) \mid F_k(m)$ for the two-block message $m \mid m$.

Another attack: suppose the attacker learns the tag $F_k(m_1) \mid F_k(m_2)$ for the message $m=m_1 \mid m_2$, and the tag $F_k(n_1) \mid F_k(n_2)$ for the message $n=n_1 \mid n_2$. Then it can forge the correct tag $F_k(m_1) \mid F_k(n_2)$ for the message $m_1 \mid n_2$. More generally, it can forge a correct tag for any message that is made by arbitrarily concatenating blocks from $m$ and $n$.

share|improve this answer

The other answer is correct in general. However, if your messages are all exactly one block long (or all one block after padding), ECB is a secure MAC.

A PRP looks like a PRF up to half its bit length, i.e. up to $2^{64}$ blocks for AES. A secure PRF is a secure MAC of the same size. Thus, AES ECB used on 128-bit messages is a secure MAC as long as you use a key for (significantly) fewer than $2^{64}$ messages.

share|improve this answer
These are good points. In fact, ECB on single-block messages is equivalent to CBC-MAC (on single-block messages), which is a secure MAC on messages of any fixed number of blocks. – Chris Peikert Sep 3 '14 at 16:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.