Both ECB and CTR block modes have advantages over other block modes. They both support parallel encryption and decryption and random reads/writes. Yet both have major disadvantages: (I'm assuming AES block sizes)
- ECB produces repeating patterns for the same 16 bytes of cleartext
- ECB can be shuffled in 16 byte blocks, which results in the cleartext to become shuffled the same way
- CTR xors the clear text to an encrypted nonce+counter. If nonce and key are reused, you can create an XOR key for encrypting/decrypting any AES-CTR encrypted file/message which uses the same key and nonce (This is mainly useful when you can encrypt data, but not read the key/nonce back from the HW AES)
Combining ECB and CTR (By first encrypting the data with ECB,then the ciphertext with CTR) will still allow parallel encryption/decryption and random reads/writes. Yet if you shuffle the blocks, the blocks that changed locations are completely broken. Plus you can't just create an xor key using the same key/nonce, as the data is then still encrypted with a different key. This will also double the key size.
My question is: Does this block mode exist? What are the main problems with an block mode like this?
EDIT: The keys for both encryptions are different, which makes it unlikely that both the ECB and the counter encryption produces the same ciphertext.