Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true?

  • Encryption of exactly 128-bit (1 block) size messages

  • Different keys used for both encryption and authentication

  • Authentication AES ECB uses encrypted ciphertext as input and outputs 128-bit MAC

  • $\begingroup$ Let me make sure I follow. You encrypt a message $m$ that is 128-bits long with AES ECB to get a ciphertext $c$. You then encrypt that ciphertext $c$ with AES ECB using a different key to get $a$. $a$ is then the MAC and $c$ is the ciphertext. Does that correctly describe the setup you are assuming? $\endgroup$ – mikeazo Sep 4 '18 at 19:55
  • $\begingroup$ @mikeazo Yes, that is correct $\endgroup$ – MateoConLechuga Sep 4 '18 at 19:56

[1] - For a single block, AES ECB is a secure MAC.

[2] - AES ECB encryption for a single block suffers from one of the problems that AES ECB suffers from in general, namely that it is deterministic. The same message encrypted with the same key results in the same ciphertext. How big of an issue is that for your application? Only you can answer that at the moment because we don't have the details of the application.

[1] - https://crypto.stackexchange.com/a/18947/706
[2] - https://crypto.stackexchange.com/a/8053/706

| improve this answer | |
  • $\begingroup$ "A single block" - One or more messages each exactly one block long? Repeating (distinct) or non-repeating? Or does that mean at most one message exactly one block long? $\endgroup$ – Future Security Sep 4 '18 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.