> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ecb.md).

# ECB

In ECB mode, each block of plaintext is encrypted independently using the same key and encryption algorithm, producing a corresponding block of ciphertext.

The encryption process is deterministic, meaning that <mark style="color:red;">**for a given key and plaintext block, the resulting ciphertext block will always be the same**</mark>.

<figure><img src="https://github.com/Hakumarachi/theCTFRecipe/blob/master/.gitbook/assets/Schema_ecb.png" alt=""><figcaption></figcaption></figure>

## How to detect ECB mode ?

If the user can supply a plaintext that is cipher by the application, then by sending a plaintext of 3 times the block size it's possible to see if ECB is used.

{% hint style="info" %}
As explained before, ECB encrypt each block independently. By sending multiple exact same blocks, the result will be exactly the same for each blocks.
{% endhint %}

Why sending 3 blocks instead of 2 ? It's cause possible misalignment.

```
+------+------+------+------+------+
| aaaa | aaaa | .... | .... | .... | plaintext
+------+------+------+------+------+
       |
       v
+------+------+------+------+------+
| xxxx | xxxx | .... | .... | .... | ciphertext
+------+------+------+------+------+       
```

but if the data is concat with non arbitrary values we can have :

```
+------+------+------+------+------+
| ..aa | aaaa | aa.. | .... | .... | plaintext
+------+------+------+------+------+
          |
          V
+------+------+------+------+------+
| xyza | xxxx | hdxz | .... | .... | ciphertext
+------+------+------+------+------+ 
```

All block are differents. The workaround is to submit a 3 times block size input.

```
       always aligned
+------+------+------+------+------+
| ..aa | aaaa | aaaa | aa.. | .... | plaintext
+------+------+------+------+------+
              |
              V
+------+------+------+------+------+
| xyza | xxxx | xxxx | hdxz  | .... | ciphertext
+------+------+------+------+------+ 
          Duplicated blocks
```