# Combining CTR and ECB modes to prevent attacks

In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR followed an ECB.

Now, while their intent was to use this for disk encryption (where the IV is just the unique (but known) location of a block on disk), this approach came with certain weaknesses due to the attack capabilities of an attacker in disk encryption theory. However, I was wondering if there are significant advantages to this CTR-then-ECB outside of necessarily a disk encryption context -- such as encrypting data in a database, for example.

Specifically, any reuse of (IV/nonce + counter) in CTR (for the same key) can trivially lead to a known-plaintext attack if the attacker knows the plaintext of any other blocks also encrypted with that (IV/nonce + counter). And not only just one (IV/nonce + counter) block, but also any "nearby" blocks belonging to those messages as well (due to counter overlap!).

However, if we encrypt with CTR-then-ECB, then the attacker will only know the plaintext of blocks if they are encrypted with the same IV+counter and also contain the same ciphertext as well. In contrast, an attacker of a CTR-only encryption scheme requires only matching IV + counter (to a known block), and an attacker of an CBC-only encryption scheme requires only matching ciphertexts (to a known block).

But is this a significant advantage, or are the probabilities involved here so minute -- especially if using random IV's -- that CTR-then-ECB fails to provide any real benefit? (for example, with AES)

• use, nonce misuse resistant scheme: AES-GCM-SIV. – kelalaka Nov 7 '20 at 8:50
• @kelalaka That would still require storage of the IV, which is probably against the idea of this mode. – Maarten Bodewes Nov 8 '20 at 14:05
• There's also ESSIV, which hashes the sector number with the encryption key. Should result in a unique and unpredictable to an attacker IV and doesn't require storage of the IV. – Swashbuckler Nov 8 '20 at 14:16
• Well, you want to use the scheme on databases. This scheme has no security against the frequency attacks against the encrypted databases. For a proper answer, you may need to provide your data's frequency and the query information. This is because, some may have solutions – kelalaka Nov 8 '20 at 15:33

There are a few problems that spring to mind:

1. this is a double-pass scheme, which is computationally expensive;
2. the leakage of blocks that are identical is unnecessary, there are schemes that only leak fully identical plaintext;