Modes of operationLegacy - avoid
Electronic Codebook mode
Block cipher mode (no IV)
How it works
ECB encrypts each block independently with the same key. Identical plaintext blocks therefore always produce identical ciphertext blocks. Encrypting a bitmap image in ECB mode famously leaves the outline of the picture (the Linux penguin example) clearly visible.
Status: Insecure for almost any data longer than one block.
Strengths
- Simple and parallel
- An error in one block does not spread to others
Weaknesses and known attacks
- Leaks patterns: repeated plaintext is visible as repeated ciphertext.
- Blocks can be reordered, removed or replayed without detection.
- No integrity protection.
Use it for
- Encrypting a single random block, such as wrapping another key, where specialised key-wrap modes are not available
Don't use it for
- Files, images, database fields, network traffic or anything with structure
Exam tip
If a question says identical plaintext produces identical ciphertext, or shows the encrypted penguin, the answer is ECB. It is the mode that does not use an IV.