ECB Mode (ARCH6113)

Key ruby.security.ecb-mode · Severity error · Category security · CWE CWE-327

ECB mode maps identical plaintext blocks to identical ciphertext, leaking data patterns, and is never semantically secure. Use an authenticated mode (GCM).

Incorrect

require "openssl"

cipher = OpenSSL::Cipher.new("aes-256-ecb")
cipher.encrypt
cipher.key = key
encrypted = cipher.update(plaintext) + cipher.final

Correct

require "openssl"

cipher = OpenSSL::Cipher.new("aes-256-gcm")
cipher.encrypt
cipher.key = key
iv = cipher.random_iv
encrypted = cipher.update(plaintext) + cipher.final
tag = cipher.auth_tag

Fix

Replace ECB mode with AES-256-GCM using a random IV.