Is It Ever Recommended To Use The ECB Cipher Mode?

3.5k views Asked by At

Judging from this Wikipedia article on cipher modes and other things I've heard about ECB, it's a big no-no and can leak information about your encrypted data. However, there are still plenty of examples out there on the 'net that utilize ECB:

Is it ever acceptable or advantageous to use ECB?

If the data is very small (one block) and you're using both a salt and an IV, is it OK? If so, where is the threshold when you stop using it?

2

There are 2 answers

2
Jarred On BEST ANSWER

If the data is very small (one block) and you're using both a salt and an IV, is it OK?

Yes

If so, where is the threshold when you stop using it?

Two blocks. There isn't any practical reason to use ECB, the only reason it exists is because it's a simple example of how to use a block cipher.

1
Maarten Bodewes On

This is better asked on crypto, but I'll answer anyway.

The ECB block cipher mode of operation is best used on randomized data, where there is no link between any of the plain text blocks. In practice, only randomized secret keys (without any additional / meta data) and random challenges (in challenge response protocols) fit that bill. The data should be a precise multiple of the block size, or collisions may still leak information. Secret keys are better protected using specific wrapping modes or modes that provide a syntactic IV (SIV modes).

Single block ECB is the same as single block CBC, with a fixed IV. It's fine for messages as long as you don't reuse the key for other data or messages. It is of course questionable if it is useful to encrypt just one message block with a key.

Most of the time it pays to simply go for CBC or, even better, GCM authenticated encryption. ECB is usually present as it may be used in legacy applications, is very easy to provide and can be used as a building block for more secure modes or MAC constructions.