# Is it safe to encrypt random data using ECB mode?

If I have 48 random bytes, is it safe to encrypt them using ECB mode? Or is there still a good reason to use another mode like CTR, CBC, etc.?

Context is this: I am creating something like a TLS session ticket where the master secret is encrypted using a server side key and sent down to the client.

I will still use HMAC. Basically, I use ECB of these 48 bytes followed by HMAC-SHA256 of the ciphertext. I have nothing against CBC, CTR, etc. But a colleague mentioned that for completely random values you can use plain ECB too and I fail to see how he's wrong.

• Can't answer that without context. But there is one thing all the modes you mentioned lack: Integrity checks/MACs. – CodesInChaos Mar 31 '15 at 10:44
• Is there anything against using CBC and a HMAC? Why not default to security? – Maarten Bodewes Mar 31 '15 at 11:29
• Sorry I failed to mention that I will still use HMAC. Basically, ECB of these 48 bytes followed by HMAC-SHA256 of the cipher text. I have nothing against CBC, CTR, etc. But a colleague mentioned that for completely random values you can use plain ECB too and I fail to see how he's wrong. – Chaitanya Gupta Mar 31 '15 at 13:22
• Context is this: I am creating something like a TLS session ticket where the master secret is encrypted using a server side key and sent down to the client. – Chaitanya Gupta Mar 31 '15 at 13:26
• In theory, it's probably safe (total plaintext less than blocksize so there's nothing to chain, though you lose an IV so if your "random data" accidentally repeats you've got a problem). In practice, it's a bad idea: If something screws up and your random data repeats you have a problem. If someone later changes things so the data sent isn't random but doesn't change the encryption, you've got a problem. Etc. It will protect you if no one screws up royally. Always expect someone to screw up royally. Use CBC, CTR, or (best) GCM. GCM makes it harder to screw up and forget the MAC. – SAI Peregrinus Mar 31 '15 at 14:06

ECB leaks if blocks are identical. For uniformly random data identical blocks become likely when you encrypt about $2^{n/2}$ blocks with an $n$ bit block cipher. CBC and CTR mode develop similar weaknesses when they encrypt that much data.