Cipher Modes & Authenticated Encryption

## What ECB does Electronic Codebook is the most literal way to use a block cipher on a long message: chop the plaintext into blocks, encrypt each block with the key, concatenate the results. There is no chaining, no IV, no counter, no state. The name is accurate — the mode behaves as if you had a codebook mapping every possible plaintext block to its ciphertext block, and you look each one up independently. That construction is deterministic, stateless, and position-independent, and each of those three properties is a distinct defect. ## Defect 1: it leaks equality, and equality is structure Because the map is deterministic, *equal input blocks produce equal output blocks*. The attacker learns the pattern of repetition in the plaintext without learning any plaintext. The famous demonstration is an image: encrypt a bitmap in ECB and the shapes remain visible, because large uniform regions of the picture are repeated identical blocks that encrypt to repeated identical ciphertext. The point generalises far beyond images. Consider a database column of encrypted values: every row holding the same value has the same ciphertext, so you get the frequency distribution for free, and frequency plus a guess about the domain (country, diagnosis code, salary band, yes/no) often identifies the values outright. Consider a fixed-format record: the constant parts are identical across all records, which tells you exactly where the variable parts start. The same determinism means the *whole message* encrypted twice under the same key gives byte-identical ciphertext, so an observer can tell that the same thing was sent again. ## Defect 2: cut-and-paste Nothing binds a block to its offset or to the message it came from. An attacker who can collect ciphertext blocks can reorder them, delete some, duplicate others, or splice blocks from one message into another, and the result decrypts into well-formed blocks of plaintext in the new arrangement. If the record format is `account | amount | recipient` on block boundaries, swapping blocks between two intercepted records is a valid transaction. Note that this is a *modification* attack; it exists in unauthenticated CBC and counter modes too, in different forms. Randomizing the mode fixes the equality leak, not the tampering — that needs an authentication tag. ## Defect 3: the ciphertext is a lookup key When the plaintext block has low entropy — a boolean, a status code, a short identifier, a value from a list of a few thousand — an attacker who can get chosen plaintexts encrypted under the same key builds a dictionary and matches every ciphertext against it. Determinism turns encryption into a reversible encoding for small domains. ## The property that is missing Any acceptable general-purpose mode must be **randomized or nonce-based**: encrypting the same plaintext twice under the same key must yield ciphertexts an adversary cannot relate. Formally this is what indistinguishability under chosen-plaintext attack demands, and a deterministic scheme cannot achieve it — the adversary submits the same message twice and compares. The randomizing element is the initialization vector or nonce: chained into the first block in CBC, or fed into the counter block in counter-style modes. Its handling is a contract in its own right (uniqueness, and in some modes unpredictability), which is a separate topic — but the reason it exists at all is precisely to destroy determinism. ## The cipher is not the problem A common confusion is to treat "ECB is broken" as a statement about the cipher. It is not: the underlying permutation is unchanged, and it is the *composition* that leaks. This is the general lesson of the whole area — the primitive is rarely where things fail; how it is composed into a scheme is. The same shape of defect shows up wherever a deterministic transform is applied to low-entropy or repetitive data: an unsalted digest of a small domain lets you precompute matches (the hashing topic owns that), and textbook, unpadded public-key encryption is deterministic for the same reason (the asymmetric topic owns that). Recognising the shape — *determinism plus a guessable domain equals disclosure* — is more valuable than memorising the ECB case. ## When determinism is deliberate There is a legitimate niche: you sometimes need equality lookups over encrypted data, so a deterministic construction (or a keyed blind index) is chosen on purpose. This is a *considered trade*, not an exception to the rule. The correct framing is: you have decided to publish the equality relation over that column, you have scoped it to a column whose equality pattern you can afford to leak, and you have not made the value itself recoverable. It never justifies ECB over a whole record. ## The ladder Structural separation here means choosing a standard authenticated, randomized mode so the properties come from the construction rather than from your care. The rungs below — transforming the data before encryption to break up repetition, validating that plaintexts look unique, detecting duplicate ciphertexts in monitoring — are all heuristics people have actually shipped in place of fixing the mode, and each is weaker than the one above it.