Skip to main content
15 votes

Implement AES-CTR on top of AES-ECB

Yes, you can do this. In fact, implementing other cipher modes is precisely what ECB mode is good for (and, indeed, just about all it is good for). To implement AES-CTR, simply fill an array of 128-...
Ilmari Karonen's user avatar
15 votes
Accepted

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a ...
kiwidrew's user avatar
  • 488
13 votes
Accepted

Are there any benefits to using ECB over CBC?

ECB benefits: It's a tiny bit easier to implement. It allows for parallel encryption and decryption (CBC only decryption). A single corrupted cipher block corrupts only one block of plain text(in ...
Meir Maor's user avatar
  • 11.8k
12 votes
Accepted

Chosen Plaintext attack on AES in ECB mode

Suppose we have a block cipher that takes a 16 byte plaintext and produces a 16 byte ciphertext (that is to say $\mathcal{Enc}: \{0,1\}^{128} \rightarrow \{0, 1\}^{128}$). We use this block cipher to ...
puzzlepalace's user avatar
  • 4,052
11 votes

Are there any benefits to using ECB over CBC?

From a theoretical point as a mode of operation ECB mode has only one advantage over all of the other modes: it doesn't require an IV. That means that the ciphertext doesn't expand if the message is a ...
Maarten Bodewes's user avatar
  • 93.3k
10 votes

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
kelalaka's user avatar
  • 49k
9 votes
Accepted

Implement AES-CTR on top of AES-ECB

Of course you can implement CTR mode if all you have is ECB. All you have to do is use ECB to encrypt the successive counter values and use the resulting ECB-ciphertext as the CTR keystream to xor ...
J.D.'s user avatar
  • 4,455
9 votes
Accepted

ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

There is no good way to calculate a strength difference between ECB and CBC. ECB is broken as a generic cipher - it is not indistinguishable under chosen plaintext attack - as repeating blocks will ...
Maarten Bodewes's user avatar
  • 93.3k
9 votes

Encrypting AES in ECB mode

Here are some things to keep in mind AES encrypts bytes, not characters. So you have to transform your plaintext into bytes. How are you going to do that? In AES, a block is 128 bits. That is 16 ...
mikeazo's user avatar
  • 38.7k
8 votes
Accepted

Does hashing an ECB encryption with a strong hash function produce a secure MAC?

No, the proposed construction is not secure, unless the block size $b$ of the block cipher is unusually large, or much wider than the MAC. Assuming $p$ known distinct message/MAC pairs $(m_i,h_i)$ ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

Encrypting Keys in a Firmware-Update

Your approach seems to have a lot of unneeded complexity and limitations. For example, you must decide the mapping between features and keys in advance. Here are some simpler approaches with more ...
EnTaroAdun's user avatar
7 votes

Which block cipher mode to use?

ECB sucks big time. CBC sucks slightly less, but still a lot. Generally speaking, when you begin to use an encryption system, it is to achieve a number of security-related properties, e.g. ...
Thomas Pornin's user avatar
7 votes
Accepted

In which cases AES doesn't need IV?

A quick list from Wikipedia; ECB : doesn't use IV and don't use ECB which is insecure, see the penguin from Wikipedia. CBC : uses IV PCB : uses IV CFB : uses IV CTR : uses IV OFB : uses IV GCM : uses ...
kelalaka's user avatar
  • 49k
7 votes
Accepted

What's the reason for Monte Carlo tests for block ciphers?

As usual, government departments simply repeat their existing rules. So they incorporated the Monte Carlo tests from earlier test documents, this time from 1980. If you follow the dusty trail from ...
Paul Uszak's user avatar
  • 15.6k
6 votes
Accepted

Why are ECB CBC and CFB parallelizable?

By parallelizable, what we mean is that the encryption/decryption process can be broken down into multiple tasks that can be run at the same time. For block cipher modes, this means that if we have ...
poncho's user avatar
  • 148k
6 votes

Why is Byte-at-a-time ECB decryption a vulnerability?

The vulnerability happens when: You send an INPUT to the server. The server appends secret to INPUT -> INPUT||secret The server encrypts it with a secret ...
MyUsername112358's user avatar
6 votes
Accepted

How can frequency analysis be applied to modern ciphers?

Classical ciphers operate on letters. If we consider the frequency attack on classical ciphers it considers the frequency of the letters. Modern ciphers, if we consider only block ciphers, operates on ...
kelalaka's user avatar
  • 49k
6 votes

OpenSSL not producing messages of expected size

You have 16 bytes to encrypt in your file. You did not set -nopad option, therefore, the OpenSSL will use the default padding, PKCS#7. This padding adds characters ...
kelalaka's user avatar
  • 49k
5 votes

encode plaintext with ecb

Well, in ECB mode you'll simply encrypt each block independently of the others with the same key and they build the correspond ciphertext blocks, which means for an encryption algorithm $E$ of block ...
Lery's user avatar
  • 7,719
5 votes
Accepted

Is AES in OFB mode with same IV more robust than ECB mode?

OFB with an IV re-use is a different kind of completely broken than ECB. In ECB mode, the problem is the fact that you can recognize blocks. That is if the same block appears twice you will notice ...
SEJPM's user avatar
  • 46.2k
5 votes

Key recovery when AES ECB is used for short but repeated messages

If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey ...
otus's user avatar
  • 32.2k
5 votes
Accepted

Is it possible to break AES-128 ECB if you are given a ciphertext and a small portion of the key?

You can't use it to "break the encryption", but you can guess at the remaining 8 bytes of the key. The remaining 8 bytes should be feasible to find, especially if you can run the search in parallel.
Ella Rose's user avatar
  • 19.7k
5 votes

Chosen Plaintext attack on AES in ECB mode

One way to carry out the chosen-prefix ECB mode attack you describe is as follows: Step 1: Obtain the ciphertexts corresponding to the following 16 plaintexts, where each ...
Ilmari Karonen's user avatar
5 votes
Accepted

How to cipher bocks with RSA in ECB mode?

Securely enciphering text with RSA is typically done in one of three ways: The most usual one is with the help of a symmetric cipher: RSA is used to establish a symmetric key, and the text itself is ...
fgrieu's user avatar
  • 142k
5 votes
Accepted

With DES, is ECB encryption mode equivalent to CBC with null IV for short data blocks?

The CBC mode processed as $c_i = E_k(p_i \oplus c_{i-1})$ with $c_0 = IV$ The ECB mode processed as $c_i = E_k(p_i)$ If you set ...
kelalaka's user avatar
  • 49k
5 votes
Accepted

Performing a dictionary attack on RSA/ECB with no padding

If the public modulus was generated properly, option 2 (brute force dictionary search of candidate plaintext) will be faster. Option 1 (factoring a ≈512-bit RSA integer) is feasible, but can be quite ...
fgrieu's user avatar
  • 142k
5 votes

AES Padding (Nullbytes vs PKCS7)

Padding You cannot fill the remaining blocks with the null bytes unless The message has a fixed size that doesn't require sending file sizes. The file size is sent over the channel. The message doesn'...
kelalaka's user avatar
  • 49k
5 votes

Protecting against CPA for AES128/ECB by using padding

Padding only affects the last part of the ciphertext. So, by definition, the other blocks before the last one are still ECB encoded without any particular alteration. So - almost by definition - it ...
Maarten Bodewes's user avatar
  • 93.3k
4 votes
Accepted

Key recovery when AES ECB is used for short but repeated messages

ECB mode has several weaknesses as discussed in Why shouldn't I use ECB encryption? but in this specific case, it does not allow to gain information about the secret key ...
Raoul722's user avatar
  • 2,836
4 votes

AES-256-ECB to encrypt VOIP audio-stream?

I would be very scared about using ECB with audio (or anything really). Note for example that attacks have been demonstrated on variable bitrate compressed encrypted audio: Despite the rapid ...
Luis Casillas's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible