Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am trying to write some code using the Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/#algorithm-overview) which provides only some of the block cipher modes for AES, intentionally excluding AES-ECB (preumably because it is not normally a good choice for anything).

My need is to use AES-ECB-nopadding as part of a key strengthening step, i.e. iterate 6000+ times to introduce some constant extra time into the decryption, resulting in a strengthened key that I can use to decrypt the rest of the data. My code is providing compatibility with an existing password system that does this (Keepass) so I don't have any choice as to what steps or algorithms to use.

Given lack of native support, can I simulate this with one of the other block ciphers, or will I have to load a third party library that includes the ECB block cipher?

I tried so far using CTR with a zero counter and never incrementing the counter. This failed due to some technical limitations (it did not support those parameters).

I think it may work to use CBC with a zero IV and just doing a single block at a time. Will that work (theoretically)?

share|improve this question

1 Answer 1

First lets acknowledge this is a horrible hack - you really should find a way to do what you want more directly or risk code maintenance issues and likely bugs in the future.

Second, while the question isn't about your key strengthening step it seems like you should ask about the security. There are lots of good key derivation methods out there and I don't consider iterating encryption to be a good one.

One Block CBC

Lets look at the algebraic structure of CBC on one block:

$ \text{cbc}(v, p) = E(v \oplus p) $

Thus if $v = 0$ $\text{cbc}(0,p) = E(0 \oplus p) = E(p)$ which is the same as ECB.


The CTR idea fail because plaintext is never part of the block encrypted by the cipher:

$ \text{ctr}(v, p) = E(v) \oplus p $

$ \text{let } v = 0 $

$ \text{ctr}(0,p) = E(0) \oplus p $

share|improve this answer
And maybe also how to decrypt? –  Paŭlo Ebermann 5 hours ago

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.