ECB vs CBC for encrypting high entropy data

Question

I have a master AES key and I need to encrypt other AES keys with this key. Is ECB safe to encrypt highly random data (a key)? What benefit would I get if I use CBC instead?

In particular, are the following methods secure, which one is more secure and why:

1. AES-ECB(random_data)
2. AES-CBC(random_data, iv = zero)
3. AES-CBC(random_data, iv = random)

Answer 1

If you look at modes designed for key wrapping or that list it as a key application, a common feature you see is that they are authenticated encryption modes that provide both message confidentiality and authenticity. See, e.g.:

• AES Key Wrap
• AES-SIV

One reason for this is that from the point of view of a malicious client, a key management system without message authentication provides:

• A decryption oracle: under the guise of asking for the decryption of a DEK, the client can request the decryption of adversarially-chosen ciphertexts with the master key;
• An encryption oracle, although depending on the design of the KMS, possibly only for randomly-chosen plaintexts:
• Some systems allow the client to submit adversarially-chosen DEKs to be encrypted, so these provide a full encryption oracle.
• Others only allow the client to obtain fresh random DEKs along with their encryptions, but this could well be useful to an adversary

Neither ECB nor CBC is secure against chosen-ciphertext attacks. So it seems prudent to use an authenticated encryption mode like GCM or SIV so that the KMS can reject malicious, client-forged encrypted DEKs.

Answer 2

ECB is fine for encrypting random data. The point of ECB is that it is secure as long as the input of the blocks isn't repeated. It's often used as a key wrapping method which seems to be your use case.

Note that ECB mode is often used incorrectly even for key wrapping. For instance because the key is embedded in a structure (e.g. PKCS#1 encoded RSA keys). In that case ECB mode may leak data not just about the structure but also about the key.

You can still get into trouble even when wrapping AES keys as neither ECB nor CBC is an authenticated cipher. So if an attacker is able to change the encrypted value you're in trouble. Padding oracles may also apply - so don't unpad an AES-192 bit key (which uses 1.5 blocks!).

---

Basically you could be OK with any option you mention - but it depends on the system as a whole. I would still choose CBC with a random IV, if just to be on the safe side. That is, if the above are the only options you have, there are better alternatives (e.g. key wrapping mode - first mentioned by Louis Casillas - or SIV mode).