# Safety of AES ECB when used with openssl_seal function

I'm trying to use PHP to encrypt files with a public key. I'm using the function openssl_seal that "encrypts data by using RC4 with a randomly generated secret key."

RC4 is considered unsafe so the alternative is to use AES ECB, but it too is generally considered unsafe (AES CBC is sadly not an option).

My question is: Is AES ECB still unsafe, even when used with a randomly generated key, which is different for each file?

• Why is CBC not an option? I don't see that limitation in the API... – Maarten Bodewes Aug 22 '15 at 14:06
• It's not documented, but all CBC ciphers fail, I suspect because there is no parameter for initialization vector and therefore they cannot work. – SimZal Aug 22 '15 at 16:01
• @SimZal, did you try OFB or CFB? If the lack of IV is the reason, they may fail as well, of course. – otus Aug 22 '15 at 16:34
• @otus I've tested AES OFB and CFB and they both fail. It is the same if I try Blowfish - ECB works, while CBC, OFB and CFB fail. – SimZal Aug 22 '15 at 16:53
• @SimZal, ok, too bad. – otus Aug 22 '15 at 16:55

• You should also consider using libsodium instead. Specifically \Sodium\crypto_box_seal(). – Scott Arciszewski Nov 8 '15 at 0:59