Hot answers tagged

104 votes
Accepted

Why shouldn't I use ECB encryption?

Why shouldn't I use ECB encryption? The main reason not to use ECB mode encryption is that it's not semantically secure — that is, merely observing ECB-encrypted ciphertext can leak information ...
user avatar
23 votes

Using ECB as RSA encryption mode when encrypted messages are unique?

The Java algorithm string "RSA/ECB/PKCS1Padding", as you already found out, does not implement ECB; it only encrypts/decrypts a single block. The Bouncy ...
user avatar
  • 85.9k
20 votes

Why shouldn't I use ECB encryption?

You should not use ECB mode because it will encrypt identical message blocks (i.e., the amount of data encrypted in each invocation of the block-cipher) to identical ciphertext blocks. This is a ...
user avatar
  • 2,857
18 votes
Accepted

Is ECB mode safe to use with RSA encryption?

It is highly misleading to call how RSA Encryption is used as 'ECB mode'. With ECB mode, we break the plaintext into N bit segments, and send each one through the block cipher separately. The block ...
user avatar
  • 134k
15 votes

Implement AES-CTR on top of AES-ECB

Yes, you can do this. In fact, implementing other cipher modes is precisely what ECB mode is good for (and, indeed, just about all it is good for). To implement AES-CTR, simply fill an array of 128-...
user avatar
15 votes
Accepted

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a ...
user avatar
  • 478
13 votes
Accepted

Are there any benefits to using ECB over CBC?

ECB benefits: It's a tiny bit easier to implement. It allows for parallel encryption and decryption (CBC only decryption). A single corrupted cipher block corrupts only one block of plain text(in ...
user avatar
  • 10.6k
12 votes
Accepted

Chosen Plaintext attack on AES in ECB mode

Suppose we have a block cipher that takes a 16 byte plaintext and produces a 16 byte ciphertext (that is to say $\mathcal{Enc}: \{0,1\}^{128} \rightarrow \{0, 1\}^{128}$). We use this block cipher to ...
user avatar
  • 3,952
11 votes
Accepted

Modes of operation that allow padding oracle attacks

In the padding oracle attack you have an oracle that only tells you whether a particular chosen ciphertext decrypts to a correctly padded plaintext. That oracle is used to build a last word oracle, ...
user avatar
  • 31.3k
11 votes
Accepted

Is it safe to encrypt random data using ECB mode?

ECB leaks if blocks are identical. For uniformly random data identical blocks become likely when you encrypt about $2^{n/2}$ blocks with an $n$ bit block cipher. CBC and CTR mode develop similar ...
user avatar
  • 24.1k
11 votes

Are there any benefits to using ECB over CBC?

From a theoretical point as a mode of operation ECB mode has only one advantage over all of the other modes: it doesn't require an IV. That means that the ciphertext doesn't expand if the message is a ...
user avatar
  • 85.9k
10 votes
Accepted

AES-ECB as an authentication mechanism

It is not secure, because an attacker can "mix and match" the output blocks from different authentication tags on different input messages, or repeat output blocks for repeated input blocks. For ...
user avatar
10 votes

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
user avatar
  • 43.5k
9 votes

Should I use ECB or CBC encryption mode for my block cipher?

Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations. Although ECB and CBC are modes of operation of a block cipher, you could ...
user avatar
  • 85.9k
9 votes

AES-ECB as an authentication mechanism

The other answer is correct in general. However, if your messages are all exactly one block long (or all one block after padding), ECB is a secure MAC. A PRP looks like a PRF up to half its bit ...
user avatar
  • 31.3k
9 votes
Accepted

I read ECB is bad because the same plaintext outputs the same ciphertext. Isn't that a requirement of a cipher?

Indeed, ECB is such that encrypting twice the same plaintext leads to the same ciphertext. Even worse, encrypting a plaintext containing twice the same plaintext block leads to a ciphertext containing ...
user avatar
  • 125k
9 votes
Accepted

ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

There is no good way to calculate a strength difference between ECB and CBC. ECB is broken as a generic cipher - it is not indistinguishable under chosen plaintext attack - as repeating blocks will ...
user avatar
  • 85.9k
9 votes
Accepted

Implement AES-CTR on top of AES-ECB

Of course you can implement CTR mode if all you have is ECB. All you have to do is use ECB to encrypt the successive counter values and use the resulting ECB-ciphertext as the CTR keystream to xor ...
user avatar
  • 4,335
9 votes

Encrypting AES in ECB mode

Here are some things to keep in mind AES encrypts bytes, not characters. So you have to transform your plaintext into bytes. How are you going to do that? In AES, a block is 128 bits. That is 16 ...
user avatar
  • 37.8k
8 votes
Accepted

Which block cipher mode does the experts use?

The modern trend for encryption-only modes is clearly CTR, which has a number of advantages over other modes: no padding is needed (contrary to CBC); the computationally-intensive part can be ...
user avatar
  • 125k
8 votes
Accepted

Implementing 5 modes of operation with a hash function

The modes you are referencing are specifically modes of operations for block ciphers, and therefore are not directly applicable to hash functions. Block cipher operations take 2 inputs, the key and a ...
user avatar
  • 12.7k
8 votes
Accepted

Does hashing an ECB encryption with a strong hash function produce a secure MAC?

No, the proposed construction is not secure, unless the block size $b$ of the block cipher is unusually large, or much wider than the MAC. Assuming $p$ known distinct message/MAC pairs $(m_i,h_i)$ ...
user avatar
  • 125k
7 votes
Accepted

Encrypting Keys in a Firmware-Update

Your approach seems to have a lot of unneeded complexity and limitations. For example, you must decide the mapping between features and keys in advance. Here are some simpler approaches with more ...
user avatar
7 votes

Which block cipher mode to use?

ECB sucks big time. CBC sucks slightly less, but still a lot. Generally speaking, when you begin to use an encryption system, it is to achieve a number of security-related properties, e.g. ...
user avatar
7 votes
Accepted

What's the reason for Monte Carlo tests for block ciphers?

As usual, government departments simply repeat their existing rules. So they incorporated the Monte Carlo tests from earlier test documents, this time from 1980. If you follow the dusty trail from ...
user avatar
6 votes
Accepted

Known plaintext, unknown 128 bit block cipher

All modern block ciphers are supposed to be pseudorandom permutations, meaning that they cannot be efficiently distinguished from a truly random permutation without knowledge of the key. (If a ...
user avatar
6 votes

What is "electronic" in electronic codebook (ECB)?

In a paper codebook, plaintext words (perhaps arranged alphabetically like in a dictionary) lead to a replacement word. Cipher for Telegraphic Correspondence — a code book used by Union General ...
user avatar
  • 125k
6 votes
Accepted

Is the 1st Encrypted Block Less Secure Than Subsequent Ones?

In the first block, the IV provides the "randomness", and in subsequent blocks you just use the previous block of ciphertext instead. Based on the assumption, that the cipher is not weak and behaves ...
user avatar
  • 12.3k
6 votes
Accepted

Why are ECB CBC and CFB parallelizable?

By parallelizable, what we mean is that the encryption/decryption process can be broken down into multiple tasks that can be run at the same time. For block cipher modes, this means that if we have ...
user avatar
  • 134k
6 votes
Accepted

How can frequency analysis be applied to modern ciphers?

Classical ciphers operate on letters. If we consider the frequency attack on classical ciphers it considers the frequency of the letters. Modern ciphers, if we consider only block ciphers, operates on ...
user avatar
  • 43.5k

Only top scored, non community-wiki answers of a minimum length are eligible