# What about using AES-ECB with random IV?

Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it as secure as using AES-CBC?

• Consider the effect of $P_i=0$. – CodesInChaos Mar 2 '16 at 9:52
• @SEJPM That's a different mode. This mode uses the xor of all previous plaintext blocks and the IV. The other question only xors two adjacent blocks. – CodesInChaos Mar 2 '16 at 9:59

No, this is not a secure way of encrypting. Specifically, it does not meet the requirements for indistinguishability under chosen plaintext attack (IND-CPA), a basic security definition for encryption.

According to IND-CPA, no attacker should be able to win the following game:

• The attacker selects two equal-length plaintext messages.
• The defender picks one of those plaintexts at random
• The defender encrypts that plaintext and provides the ciphertext to the attacker
• The attacker wins if it can determine which of the plaintexts was used

Here's a winning strategy for an attacker facing your scheme:

• Let plaintext message 1 consist of a single block containing only zero bits.
• Let plaintext message 2 be any other single-block message.
• If the defender returns a ciphertext where the two ciphertext blocks are equal, then the attacker knows that plaintext message 1 was selected; else, the attacker knows that plaintext message 2 was selected.

Here's why this works:

In plaintext message 1, $P_1 = 0^n$ (i.e. $n$ zero bits), where $n$ is the number of bits in a block. This means that $M_1 = M_0 \oplus P_1 = M_0 \oplus 0^n = M_0$, so $M_1 = M_0$. ECB mode produces ciphertext blocks $C_i = E_k(M_i)$, and $E_k$ is deterministic, so the ciphertext blocks will also match ($C_1 = C_0$).

In plaintext message 2, this equality will not hold: $P_1$ has at least one non-zero bit, so $M_1$ and $M_0$ will differ in at least one bit, resulting in different ciphertext blocks ($C_1 \neq C_0$).

• I think it would be useful to note that the attack extends to later blocks even if the IV is not encrypted. – otus Mar 2 '16 at 11:49