If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other bodies and are still recommended?

The last publication that I am aware of is: Recommendation for Block Cipher Modes of Operation.

From the document:

"This recommendation specifies five confidentiality modes of operation for symmetric key block cipher algorithms, such as the algorithm specified in FIPS Pub. 197, the Advanced Encryption Standard (AES) [2]. The modes may be used in conjunction with any symmetric key block cipher algorithm that is approved by a Federal Information Processing Standard (FIPS). The five modes—the Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR) modes—can provide data confidentiality."

  • $\begingroup$ Banned? Nist recommends not bans. $\endgroup$
    – kelalaka
    Commented Sep 24, 2019 at 11:04
  • $\begingroup$ yeah but why they recommend something that is not secure? $\endgroup$
    – Crypto_dxb
    Commented Sep 24, 2019 at 11:07
  • $\begingroup$ It is final but old and legacy 2001 document. See this but NIST down? $\endgroup$
    – kelalaka
    Commented Sep 24, 2019 at 11:12
  • $\begingroup$ did you actually read the document? "In the ECB mode, under a given key, any given plaintext block always gets encrypted to the same ciphertext block. If this property is undesirable in a particular application, the ECB mode should not be used." $\endgroup$ Commented Sep 24, 2019 at 17:57

1 Answer 1


All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an unpredictable IV in the case of CBC.

Only authenticated modes can achieve message integrity / authenticity. Others are all vulnerable because changes to the ciphertext cannot be detected. Originally a lot of effort was spend on error propagation due to unreliable transport. This is what is meant when bit flipping attacks are mentioned. However, in modern times, the encryption is commonly performed in a higher layer where error correction has already been performed. So we're mainly interested in protecting against targeted attacks. Mixing confidentiality and error detection is not a big topic anymore.

As indicated, any of these old modes can be used to achieve confidentiality. For a higher level of security for actual messages you would probably want to use newer recommendations such as GCM and CCM though. However, above modes have not been broken so there is no need to retract them; that would involve rewriting many systems that are compliant.

Although ECB mode can be used for small messages (single block encrypt) or as building block, I guess ECB is the most contentious mode of the bunch. Even as building block, you could argue that directly using the block cipher makes more sense. But please do note that many higher level API's do not directly expose the block cipher to the user; you'd need to use ECB mode instead.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.