I wanna make my own "way" of encrypting separate messages. And I want it to have the least possible size overhead while being completely encrypted (hide msg counter). Here's my current idea:
- we exchange some symmetric key K, along with random 32-bit counter start position
- for every message:
- p1 = first 12 bytes of payload, p2 = the rest of payload
- enc_header = aes_ecb_encrypt(K, counter || p1)
- IV = some_secure_hash(K || counter)
- enc_data_with_mac = aes_gcm_encrypt(K, IV, p2) // or chacha20+poly1305
- result = enc_header || enc_data
- Every message increments counter by one. Before counter overflows we prepare new K, then use it after overflow, then as soon as receiver receives message encrypted with new key, he forgets old one.
As result, every message contains only 4+16 (counter+MAC) additional bytes and everything including counter is encrypted so only sender and receiver know what data is hidden.
Yes, this explanation is quite simplified. I hope this is enough to understand the idea. The main question is about using ECB mode this way. Just tell me why described algorithm is bad. Also, does random counter start position make this scheme more secure?