# Safety of AES ECB when used with openssl_seal function

I'm trying to use PHP to encrypt files with a public key. I'm using the function openssl_seal that "encrypts data by using RC4 with a randomly generated secret key."

RC4 is considered unsafe so the alternative is to use AES ECB, but it too is generally considered unsafe (AES CBC is sadly not an option).

My question is: Is AES ECB still unsafe, even when used with a randomly generated key, which is different for each file?

• Why is CBC not an option? I don't see that limitation in the API... Aug 22, 2015 at 14:06
• It's not documented, but all CBC ciphers fail, I suspect because there is no parameter for initialization vector and therefore they cannot work. Aug 22, 2015 at 16:01
• @SimZal, did you try OFB or CFB? If the lack of IV is the reason, they may fail as well, of course.
– otus
Aug 22, 2015 at 16:34
• @otus I've tested AES OFB and CFB and they both fail. It is the same if I try Blowfish - ECB works, while CBC, OFB and CFB fail. Aug 22, 2015 at 16:53
– otus
Aug 22, 2015 at 16:55

• You should also consider using libsodium instead. Specifically \Sodium\crypto_box_seal(). Nov 8, 2015 at 0:59