AES-ECB known ciphertext/plaintext attack

Question

i'm new to crypto and am working on a little exercise to understand the weakness of ECB mode encryption. Here is the scenario.

I have the plain text

I am not tall

and the associated cipher-text generated using an unknown key with AES-ECB.

Is there any way, apart from brute force, I can change generate the ciphertext for the string

I am yes tall

using the information that's available to me?

Answer 1

Knowing the AES-ECB ciphertext for I am not tall does not help you find you the ciphertext for I am yes tall. (Well, it does, but it only rules out one possibility among $2^{128}$ — it can't be the same ciphertext.) ECB has several weaknesses, but not this one. In fact, if you only want to encrypt a single 16-byte message, ECB is fine. The reason ECB is almost never used except by people who don't know better is that encrypting a single message with a forced size is not common.

If the message was longer than 1 block (16 bytes for AES, regardless of the key size), then ECB would start showing its weaknesses. For example, the encryption of I am not tall...I am not tall... is 32 bytes of which the first 16 are identical to the last 16, because the block I am not tall... is encrypted twice. Secure modes vary the way the plaintext is encrypted from block to block; for example, CTR uses the block number, while other modes such as CBC and OFB use some form of “feedback” from one block to the next.

Similarly, if you encrypt more than one message with the same key, ECB will reveal blocks that are common to the two messages. For example, the encryptions of Hello everyone, I am not tall and Hello everyone, I am yes tall start with the same ciphertext block, which is the encryption of Hello everyone, . Secure modes use an initialization vector to make each generated ciphertext depend on something unique: encrypting the same message with the same key but with a different IV produces different results. (CTR's counter isn't exactly an IV, but serves a similar role.)