Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ?

  1. AES-ECB($key$ , $msg$)
  2. SIV($key$, NIL , $msg$) where associated data is NIL.

I could not make out much from Rogaway and Shrimpton's paper on "Deterministic Authenticated Encryption" which introduces Synthentic IV (SIV) mode.

Edit: Here $msg$ is same as single block .

  • 2
    $\begingroup$ SIV. As long as an adversary never submits exactly the same message the ciphertext remains indistinguishable from random bits $\endgroup$ Feb 19 '14 at 12:57
  • 2
    $\begingroup$ No, in ECB mode submitting the same block will leak information - rather than SIV where the entire message must be the same to leak information $\endgroup$ Feb 19 '14 at 13:18
  • 2
    $\begingroup$ For a single block, ECB is perfectly fine. $\endgroup$ Feb 19 '14 at 15:40
  • 2
    $\begingroup$ Imagine some data type that is 128 bits like say IPv6 address and for some reason i want to encrypt it deterministically. $\endgroup$
    – sashank
    Feb 19 '14 at 16:32
  • 6
    $\begingroup$ @pg1989 : $\:$ No; SIV also provides authentication. $\;\;\;\;$ $\endgroup$
    – user991
    Dec 22 '14 at 19:24


  • Secure deterministic encryption for one-block messages.


  • No expansion for block-sized messages.
  • Faster.


  • Authentication.
  • Works for messages of any size.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.