If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode?

This problem can be generalized to given a block cipher $C_0$ which has a block size of $k$-bit and a random bit string $S$ whose length is $n \cdot k$ where $n$ is a positive integer; in such settings, what would the security risks be to encrypt $S$ with $C_0$ in ECB mode?

I've read this thread Is it safe to encrypt random data using ECB mode?, which gives a good answer to a more generalized question. But in this case, $n$ is (assumedly) generally small, and the benefit to use a simple mode like ECB without op mode parameters (IVs, nonces, etc.) over more advanced modes like CTR is significant enough. Also although not mentioned in the link above, this specific setting doesn't involve padding, which makes the situation even simpler.


1 Answer 1


In general, this is a bad idea. I won't give you any concrete attacks, but will try to explain why you shouldn't do this. In general, if you want to encrypt a key then you should do it using a secure mode for this purpose. (One is the SIV mode of operation. Another is just to use GCM or CCM.) First, I want to stress that you should always use an authenticated encryption mode, by default. Next, the problem of encrypting with ECB is that it has ramifications that can be problematic. In order to see this, denote by $(c_1,c_2)$ the two blocks encrypting the key $k$ which is 256 bits long. Denote $k=k_1\|k_2$ where each $k_1,k_2$ is 128 bits long (Thus $c_1$ is an encryption of $k_1$ and $c_2$ is an encryption of $k_2$.) Now, given $(c_1,c_2)$, it is possible to replace the two blocks of the encrypted key with $(c_1,c_1)$ or with $(c_2,c_2)$. If an attacker can get some plaintext/ciphertext pairs with $(c_1,c_1)$, then it can learn $k_1$ in time $2^{128}$. It can then do the same with $(c_2,c_2)$ and the result is that the entire 256-bit key can be learned in time $2^{129}$. Now, $2^{128}$ is beyond the capabilities of what can be done. However, if you are using a 256-bit key, then you clearly think that $2^{128}$ is not enough of a margin. By using ECB, you have reduced the security down to $2^{128}$. Beyond this, if you can get encryptions under this key, then you can play around to get encryptions under $k_1\|k_2$, $k_2\|k_1$, $k_1\|k_1$ and $k_2\|k_2$. These are all related keys and there are weaknesses to AES under related key attacks. Even if we don't have a concrete attack on this, it is certainly a threat that should not be ignored.

Bottom line, there is no reason to encrypt with ECB so don't do it. If you do, you certainly run the risk of significantly reducing the complexity of the attack. Make sure that you use an authenticated encryption mode (if you encrypt with CTR then you can flip bits and once again get a related-key attack).

  • $\begingroup$ Thanks for your excellent answer. I'm aware that it is generally a bad idea to use ECB in most situations and that's why I'm asking this question. To me, the first security risk you proposed is a special version of known-plaintext attack, which is only realistic on a portion of systems that may apply such key wrapping method. I'm also aware that it would be the best to use specialized modes like SIV for key wrapping, but I want to learn the risks related to this method to help deciding the trade off between space and security. $\endgroup$ Dec 8, 2015 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.