Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true?

  • Encryption of exactly 128-bit (1 block) size messages

  • Different keys used for both encryption and authentication

  • Authentication AES ECB uses encrypted ciphertext as input and outputs 128-bit MAC

  • $\begingroup$ Let me make sure I follow. You encrypt a message $m$ that is 128-bits long with AES ECB to get a ciphertext $c$. You then encrypt that ciphertext $c$ with AES ECB using a different key to get $a$. $a$ is then the MAC and $c$ is the ciphertext. Does that correctly describe the setup you are assuming? $\endgroup$
    – mikeazo
    Commented Sep 4, 2018 at 19:55
  • $\begingroup$ @mikeazo Yes, that is correct $\endgroup$ Commented Sep 4, 2018 at 19:56

1 Answer 1


[1] - For a single block, AES ECB is a secure MAC.

[2] - AES ECB encryption for a single block suffers from one of the problems that AES ECB suffers from in general, namely that it is deterministic. The same message encrypted with the same key results in the same ciphertext. How big of an issue is that for your application? Only you can answer that at the moment because we don't have the details of the application.

[1] - https://crypto.stackexchange.com/a/18947/706
[2] - https://crypto.stackexchange.com/a/8053/706

  • $\begingroup$ "A single block" - One or more messages each exactly one block long? Repeating (distinct) or non-repeating? Or does that mean at most one message exactly one block long? $\endgroup$ Commented Sep 4, 2018 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.