A team encrypts an order log with AES in ECB mode and argues it is safe because AES itself is unbroken. Describe exactly what an attacker learns from the ciphertext, then explain why CBC with a…

Question

A team encrypts an order log with AES in ECB mode and argues it is safe because AES itself is unbroken. Describe exactly what an attacker learns from the ciphertext, then explain why CBC with a repeated initialisation vector is also broken and by what different mechanism.

Accepted Answer

ECB leaks equality of plaintext blocks, so an attacker sees which 16-byte blocks repeat and recovers structure and often content without touching AES at all. Under a fixed key the cipher is a deterministic permutation on 16-byte blocks, so identical plaintext blocks give identical ciphertext blocks. In an order log that means the attacker counts how often each instrument, side or size appears, matches the frequency profile against public volume data, and identifies the fields. Records that are identical apart from a timestamp are visible as such, and an attacker who can submit chosen plaintext builds a dictionary of block to ciphertext and decrypts the log by lookup. Blocks can also be reordered, deleted or spliced between messages and the result still decrypts. CBC fixes the deterministic block problem by chaining each block with the previous ciphertext, but it needs an initialisation vector that is unpredictable and never repeated. If the IV repeats under the same key, two messages with the same first block produce the same first ciphertext block, restoring the equality leak on the prefix and revealing the length of the shared prefix. A predictable IV is worse: it allows a chosen plaintext attack in which the attacker guesses a block and confirms the guess. Neither mode authenticates, so both permit an attacker to modify ciphertext.