2

Can AES ECB mode be used for both encryption and authentication, assuming the following conditions are always true?

  • Encryption of exactly 128-bit (1 block) size messages

  • Different keys used for both encryption and authentication

  • Authentication AES ECB uses encrypted ciphertext as input and outputs 128-bit MAC

MateoConLechuga
  • 123
  • 5
  • Let me make sure I follow. You encrypt a message $m$ that is 128-bits long with AES ECB to get a ciphertext $c$. You then encrypt that ciphertext $c$ with AES ECB using a different key to get $a$. $a$ is then the MAC and $c$ is the ciphertext. Does that correctly describe the setup you are assuming? – mikeazo Sep 04 '18 at 19:55
  • @mikeazo Yes, that is correct – MateoConLechuga Sep 04 '18 at 19:56

1 Answers1

3

[1] - For a single block, AES ECB is a secure MAC.

[2] - AES ECB encryption for a single block suffers from one of the problems that AES ECB suffers from in general, namely that it is deterministic. The same message encrypted with the same key results in the same ciphertext. How big of an issue is that for your application? Only you can answer that at the moment because we don't have the details of the application.

[1] - https://crypto.stackexchange.com/a/18947/706
[2] - https://crypto.stackexchange.com/a/8053/706

mikeazo
  • 38,563
  • 8
  • 112
  • 180
  • "A single block" - One or more messages each exactly one block long? Repeating (distinct) or non-repeating? Or does that mean at most one message exactly one block long? – Future Security Sep 04 '18 at 23:04