ECB Mode (ARCH4113)

Key java.security.ecb-mode · Severity error · Category security · CWE CWE-327

ECB mode maps identical plaintext blocks to identical ciphertext, leaking data patterns, and is never IND-CPA secure. Use an authenticated mode such as GCM.

Incorrect

Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); // leaks patterns
cipher.init(Cipher.ENCRYPT_MODE, key);
byte[] ct = cipher.doFinal(plaintext);

Correct

byte[] iv = new byte[12];
SecureRandom.getInstanceStrong().nextBytes(iv);
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
byte[] ct = cipher.doFinal(plaintext);

Fix

Use an authenticated mode such as AES-GCM with a random IV instead of ECB.