ECB cipher mode (ARCH310)

Key dotnet.security.ecb-mode · Severity error · Category security · CWE CWE-327

ECB mode maps identical plaintext blocks to identical ciphertext, exposing data patterns. Use an authenticated mode with a random IV.

Incorrect

using var aes = Aes.Create();
aes.Mode = CipherMode.ECB;
var encryptor = aes.CreateEncryptor();

Correct

using var aes = new AesGcm(key, AesGcm.TagByteSizes.MaxSize);
RandomNumberGenerator.Fill(nonce);
aes.Encrypt(nonce, plaintext, ciphertext, tag);

Fix

Replace CipherMode.ECB with an authenticated mode (AES-GCM) and a random per-message nonce/IV.