In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR followed an ECB.
Now, while their intent was to use this for disk encryption (where the IV is just the unique (but known) location of a block on disk), this approach came with certain weaknesses due to the attack capabilities of an attacker in disk encryption theory. However, I was wondering if there are significant advantages to this CTR-then-ECB outside of necessarily a disk encryption context -- such as encrypting data in a database, for example.
Specifically, any reuse of
(IV/nonce + counter) in CTR (for the same key) can trivially lead to a known-plaintext attack if the attacker knows the plaintext of any other blocks also encrypted with that
(IV/nonce + counter). And not only just one
(IV/nonce + counter) block, but also any "nearby" blocks belonging to those messages as well (due to counter overlap!).
However, if we encrypt with CTR-then-ECB, then the attacker will only know the plaintext of blocks if they are encrypted with the same
IV+counter and also contain the same ciphertext as well. In contrast, an attacker of a CTR-only encryption scheme requires only matching
IV + counter (to a known block), and an attacker of an CBC-only encryption scheme requires only matching ciphertexts (to a known block).
But is this a significant advantage, or are the probabilities involved here so minute -- especially if using random IV's -- that CTR-then-ECB fails to provide any real benefit? (for example, with AES)