4
$\begingroup$

I have a master AES key and I need to encrypt other AES keys with this key. Is ECB safe to encrypt highly random data (a key)? What benefit would I get if I use CBC instead?

In particular, are the following methods secure, which one is more secure and why:

  1. AES-ECB(random_data)
  2. AES-CBC(random_data, iv = zero)
  3. AES-CBC(random_data, iv = random)
$\endgroup$
3
$\begingroup$

If you look at modes designed for key wrapping or that list it as a key application, a common feature you see is that they are authenticated encryption modes that provide both message confidentiality and authenticity. See, e.g.:

One reason for this is that from the point of view of a malicious client, a key management system without message authentication provides:

  • A decryption oracle: under the guise of asking for the decryption of a DEK, the client can request the decryption of adversarially-chosen ciphertexts with the master key;
  • An encryption oracle, although depending on the design of the KMS, possibly only for randomly-chosen plaintexts:
    • Some systems allow the client to submit adversarially-chosen DEKs to be encrypted, so these provide a full encryption oracle.
    • Others only allow the client to obtain fresh random DEKs along with their encryptions, but this could well be useful to an adversary

Neither ECB nor CBC is secure against chosen-ciphertext attacks. So it seems prudent to use an authenticated encryption mode like GCM or SIV so that the KMS can reject malicious, client-forged encrypted DEKs.

$\endgroup$
3
$\begingroup$

ECB is fine for encrypting random data. The point of ECB is that it is secure as long as the input of the blocks isn't repeated. It's often used as a key wrapping method which seems to be your use case.

Note that ECB mode is often used incorrectly even for key wrapping. For instance because the key is embedded in a structure (e.g. PKCS#1 encoded RSA keys). In that case ECB mode may leak data not just about the structure but also about the key.

You can still get into trouble even when wrapping AES keys as neither ECB nor CBC is an authenticated cipher. So if an attacker is able to change the encrypted value you're in trouble. Padding oracles may also apply - so don't unpad an AES-192 bit key (which uses 1.5 blocks!).


Basically you could be OK with any option you mention - but it depends on the system as a whole. I would still choose CBC with a random IV, if just to be on the safe side. That is, if the above are the only options you have, there are better alternatives (e.g. key wrapping mode - first mentioned by Louis Casillas - or SIV mode).

$\endgroup$
  • 4
    $\begingroup$ There may also be a problem with loss of semantic security. If you encrypt the same random key twice, an external party can deduce that this is the same key. Whether or not this is a problem is dependent upon the system as a whole, but in any event unless you have an overwhelmingly compelling reason to just use ECB here, I'd still stick with something like GCM. Better to have it be overkill than to assume your keys will always be 128-bit and be wrong, to assume that leaking key equality is fine and be wrong, or to assume key tampering is not a concern and be wrong. $\endgroup$ – Stephen Touset Mar 28 '17 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.