Why weak modes of operations are not banned?

Question

If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other bodies and are still recommended?

The last publication that I am aware of is: Recommendation for Block Cipher Modes of Operation.

From the document:

"This recommendation specifies five confidentiality modes of operation for symmetric key block cipher algorithms, such as the algorithm specified in FIPS Pub. 197, the Advanced Encryption Standard (AES) [2]. The modes may be used in conjunction with any symmetric key block cipher algorithm that is approved by a Federal Information Processing Standard (FIPS). The five modes—the Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR) modes—can provide data confidentiality."

Answer 1

All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an unpredictable IV in the case of CBC.

Only authenticated modes can achieve message integrity / authenticity. Others are all vulnerable because changes to the ciphertext cannot be detected. Originally a lot of effort was spend on error propagation due to unreliable transport. This is what is meant when bit flipping attacks are mentioned. However, in modern times, the encryption is commonly performed in a higher layer where error correction has already been performed. So we're mainly interested in protecting against targeted attacks. Mixing confidentiality and error detection is not a big topic anymore.

As indicated, any of these old modes can be used to achieve confidentiality. For a higher level of security for actual messages you would probably want to use newer recommendations such as GCM and CCM though. However, above modes have not been broken so there is no need to retract them; that would involve rewriting many systems that are compliant.

Although ECB mode can be used for small messages (single block encrypt) or as building block, I guess ECB is the most contentious mode of the bunch. Even as building block, you could argue that directly using the block cipher makes more sense. But please do note that many higher level API's do not directly expose the block cipher to the user; you'd need to use ECB mode instead.