I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data.

I assume the availability of a secure device that can:

• Store a unique, constant ('master') key that is to be used for all PCNs
• If necessary, store a unique, constant IV to be used for all encryption with the master key
• Encrypt (AES-256) data in ECB or CBC mode
• Decrypt (AES-256) data in ECB or CBC mode

What are the relative merits and demerits of the following possible options for encryption and decryption?:

1. Use the master key in ECB mode. I have heard/read that this is cryptographically weak (Why?).

2. Use the master key and IV in CBC mode.

3. Prepend a 16-byte, microsecond-or-finer, timestamp to the PCN, then use the master key and IV in CBC mode. This would mean storing an additional 16-byte block of ciphertext, but this isn't a problem. On decryption, just discard the first 16 bytes of the resulting plaintext.

4. (If available) As (3), but have the device provide a 16-byte pseudo-IV.

5. Something better (please specify)

Extra kudos for explaining possible attacks on a large quantity of sixteen-digit numbers encrypted under any of these schemes.

I'm new at this, and I know it's very easy for noobs to produce stuff that an average cryptologist would find laughable, so please be gentle -- I'm just trying to learn.

I've placed this here, rather than on security.SE, because it looks like a better fit; if y'all disagree, I shall be most grateful if you will migrate it, rather than closing as off-topic.

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data.

I assume the availability of a secure device that can:

• Store a unique, constant ('master') key that is to be used for all PCNs
• If necessary, store a unique, constant IV to be used for all encryption with the master key
• Encrypt (AES-256) data in ECB or CBC mode
• Decrypt (AES-256) data in ECB or CBC mode

What are the relative merits and demerits of the following possible options for encryption and decryption?:

1. Use the master key in ECB mode. I have heard/read that this is cryptographically weak (Why?).

2. Use the master key and IV in CBC mode.

3. Prepend a 16-byte, microsecond-or-finer, timestamp to the PCN, then use the master key and IV in CBC mode. This would mean storing an additional 16-byte block of ciphertext, but this isn't a problem. On decryption, just discard the first 16 bytes of the resulting plaintext.

4. (If available) As (3), but have the device provide a 16-byte pseudo-IV.

5. Something better (please specify)

Extra kudos for explaining possible attacks on a large quantity of sixteen-digit numbers encrypted under any of these schemes.

I'm new at this, and I know it's very easy for noobs to produce stuff that an average cryptologist would find laughable, so please be gentle -- I'm just trying to learn.

I've placed this here, rather than on security.SE, because it looks like a better fit; if y'all disagree, I shall be most grateful if you will migrate it, rather than closing as off-topic.

For additional clarification, following the answer from @curious :

The reason I include ECB mode here is that it could allow me to save half the storage space. Since the messages are only one block long, I suspect this may affect the 'traditional' arguments against ECB.

But I am interested in understanding whether there are any specific vulnerabilities arising from:

• The relatively low entropy of the messages (message space of 1E16 possibilities, reduced by PCN checksums)
• The use of a fixed, universal key or key+IV