3
$\begingroup$

If I have 48 random bytes, is it safe to encrypt them using ECB mode? Or is there still a good reason to use another mode like CTR, CBC, etc.?

Context is this: I am creating something like a TLS session ticket where the master secret is encrypted using a server side key and sent down to the client.

I will still use HMAC. Basically, I use ECB of these 48 bytes followed by HMAC-SHA256 of the ciphertext. I have nothing against CBC, CTR, etc. But a colleague mentioned that for completely random values you can use plain ECB too and I fail to see how he's wrong.

Improve this question
$\endgroup$
8
  • 5
    $\begingroup$ Can't answer that without context. But there is one thing all the modes you mentioned lack: Integrity checks/MACs. $\endgroup$
    – CodesInChaos
    Commented Mar 31, 2015 at 10:44
  • 1
    $\begingroup$ Is there anything against using CBC and a HMAC? Why not default to security? $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 31, 2015 at 11:29
  • $\begingroup$ Sorry I failed to mention that I will still use HMAC. Basically, ECB of these 48 bytes followed by HMAC-SHA256 of the cipher text. I have nothing against CBC, CTR, etc. But a colleague mentioned that for completely random values you can use plain ECB too and I fail to see how he's wrong. $\endgroup$
    – Chaitanya Gupta
    Commented Mar 31, 2015 at 13:22
  • $\begingroup$ Context is this: I am creating something like a TLS session ticket where the master secret is encrypted using a server side key and sent down to the client. $\endgroup$
    – Chaitanya Gupta
    Commented Mar 31, 2015 at 13:26
  • $\begingroup$ In theory, it's probably safe (total plaintext less than blocksize so there's nothing to chain, though you lose an IV so if your "random data" accidentally repeats you've got a problem). In practice, it's a bad idea: If something screws up and your random data repeats you have a problem. If someone later changes things so the data sent isn't random but doesn't change the encryption, you've got a problem. Etc. It will protect you if no one screws up royally. Always expect someone to screw up royally. Use CBC, CTR, or (best) GCM. GCM makes it harder to screw up and forget the MAC. $\endgroup$
    – SAI Peregrinus
    Commented Mar 31, 2015 at 14:06

1 Answer 1

Reset to default
11
$\begingroup$

ECB leaks if blocks are identical. For uniformly random data identical blocks become likely when you encrypt about $2^{n/2}$ blocks with an $n$ bit block cipher. CBC and CTR mode develop similar weaknesses when they encrypt that much data.

=> As long as you encrypt reasonable amounts (up to a petabyte or so) of random data with a 128 bit block cipher, like AES, a passive attacker doesn't learn anything useful from observing your ECB encrypted messages.

Still I see little reason to use ECB when you could use something stronger. You're coupling the security of your encryption to assumptions about the data you're encrypting. If a future version of your software changes the properties of the data, you need to remember that you need to replace the encryption.

Against active attackers you need to add some kind of MAC, either via a generic encrypt-then-mac combination or by using an authenticated mode of operation, like GCM.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Perhaps, in the second paragraph: reasonable amounts of random data $\endgroup$
    – fgrieu ♦
    Commented Apr 1, 2015 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.