What ECB Leaks

Encrypt a picture with one key, under five modes. Count the ciphertext blocks that repeat. Then add noise to the picture, and watch the leak disappear.

Block ciphersECBdemo

Objectives

Explain why two equal plaintext blocks give two equal ciphertext blocks under ECB.
Measure the leak as a count of distinct blocks rather than as an appearance.
Compare ECB against CBC, CFB, OFB and CTR on one message under one key.
Predict what changing the key does to the ciphertext image, and what it does not do.
Distinguish a property of the mode from a property of the plaintext, using a message whose blocks stop repeating.

25%

Encrypt one picture under each mode, with one key, and look at the ciphertext.

A picture is a byte string

The picture below is 192 by 192 pixels. Each pixel is three bytes, one for red, one for green and one for blue, so the whole picture is 110,592 bytes. A block cipher works on 16 bytes at a time, so one block covers 5.33 pixels, and the picture is exactly 6,912 whole blocks. Nothing here needs padding.

The picture

encrypting

The count under the picture is the measurement this page is built on. It is the number of blocks whose 16 bytes are not equal to those of any other block. The picture is drawn with five flat colours, so most of its blocks are copies of each other: only … of 6,912 blocks are different from all the rest.

The page draws the picture from circles and ellipses when it loads, with no smoothing at the edges, so every machine in the room holds the same bytes and prints the same counts.

ECB encrypts each block on its own

C[i] = E(K, P[i])

Electronic codebook mode encrypts every block under the same key and with nothing else. The block at one position does not depend on the block before it, so two equal plaintext blocks always give two equal ciphertext blocks.

The right-hand picture is the ciphertext, shown as if it were still a picture: the same 192 by 192 pixels, three bytes each, and no decryption anywhere. Every byte in it came out of AES.

Plaintext

encrypting

ECB ciphertext

encrypting

The two counts are equal, and that is the leak. … distinct plaintext blocks become … distinct ciphertext blocks, because a repeated input repeats on the way out. The colours carry nothing. What survives is the map of where the plaintext changed, and that map is the outline of the subject.

the key

2B7E151628AED2A6ABF7158809CF4F3C

Change the key. Every colour in the ciphertext changes and the outline does not move. The leak belongs to the mode, so no key repairs it, and a stronger cipher does not either.

The other four modes of SP 800-38A

The same picture, the same key and the same AES, under each of the other four modes. Each of them brings something into the block besides the plaintext: the ciphertext block before it, or a counter value that does not repeat. Two equal plaintext blocks therefore stop giving two equal ciphertext blocks.

CBC ciphertext

encrypting

CFB ciphertext

encrypting

OFB ciphertext

encrypting

CTR ciphertext

encrypting

Each mode of SP 800-38A, what it needs beside the key, and how many of the 6912 ciphertext blocks it leaves distinct.
Mode	Block i	Needs	Distinct blocks
ECB	C[i] = E(K, P[i])	nothing	…
CBC	C[i] = E(K, P[i] XOR C[i-1]), C[-1] = IV	an IV	…
CFB	C[i] = P[i] XOR E(K, C[i-1]), C[-1] = IV	an IV	…
OFB	S[i] = E(K, S[i-1]), C[i] = P[i] XOR S[i], S[-1] = IV	an IV	…
CTR	C[i] = P[i] XOR E(K, T[i]), T[i] = T[0] + i	a counter block	…

The marked row is the one that left two ciphertext blocks equal. The other four reach 6,912 of 6,912.

Read the second column rather than the pictures. ECB is the only row whose right-hand side does not depend on i, and that is the same fact the pictures show.

Four pictures that look alike are not four modes that are alike. They differ in what they need beside the key, in what a transmission error destroys, and in whether the keystream can be computed before the message arrives. None of the four detects a change made to the ciphertext.

The leak is repetition, not the picture

A real camera adds a little noise to every pixel. Add that kind of noise here and encrypt the result under ECB again, with the mode, the key and the subject all unchanged.

camera noise, in levels out of 255

Plaintext

encrypting

ECB ciphertext

encrypting

At one level of noise most of the repeated blocks are gone, and the outline goes with them. Sixteen bytes is a long thing to repeat by accident, so a photograph rarely repeats one. The picture itself still looks the same to you: two levels out of 255 is not visible.

That is not a defence of ECB. The mode did not improve, the plaintext did. ECB promises nothing about what it hides, so what it happens to hide depends on the message, and the sender is rarely in a position to know. Documents, database fields, protocol headers and flat artwork all repeat blocks readily.

ECB is not AES with a bug. FIPS 81 defined it in 1980 for DES and SP 800-38A restated it in 2001 for any approved block cipher, and both are still correct about what it computes. The mode is the layer that decides what a repeated block looks like, and ECB decided to show it. Everything on this page is a teaching implementation written to be read: use a reviewed library for anything real, and prefer an authenticated mode, because none of the five modes here notices a ciphertext that an attacker has changed.

step 1/4

CPE 645 / CS 685

What ECB Leaks

Trading Known Plaintext for Time Against Two-Key TDEA

MD5, Step by Step