What are the pros/cons of using AES ECB mode to encrypt encryption keys (data encryption keys or DEKs)? Aware of the significant weaknesses when it come to encrypting low-entropy data that's greater than a block size and also aware of AES Key wrapping functions (nice post). The low efficiency of AES KW in high throughput cases is an issue in our case (thousands/millions of fields flowing, each encrypted with own DEK).
In our case, the data encryption keys
- are high entropy (hardware RNG + 4 PRNG sources + crypto-hash expansion) and
- will be 128/256 bits long (concerns on even longer keys?)
We're avoiding AES-GCM etc to skip the IV to reduce the size since every byte is precious (big data/high volume)
- Integrity of the DEK isn't a concern in the threat model. DEK tampering will trigger decryption failure affecting Availability. Availability is a concern at a higher system level. (Also, if an attacker can modify the DEK bits, they can simply delete the entire field/data payload just after the encrypted DEK)
- The main concerns are Confidentiality and Integrity of the data itself.