ECB mode usage (ARCH2113)

Key python.security.ecb-mode · Severity error · Category security · CWE CWE-327

ECB mode maps identical plaintext blocks to identical ciphertext, leaking data patterns, and is never IND-CPA secure. ECB must never be used for confidentiality.

Incorrect

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

cipher = Cipher(algorithms.AES(key), modes.ECB())
ct = cipher.encryptor().update(data)

Correct

from cryptography.hazmat.primitives.ciphers.aead import AESGCM

aesgcm = AESGCM(key)
nonce = os.urandom(12)
ct = aesgcm.encrypt(nonce, data, None)

Fix

Use an authenticated mode (AES-GCM) or CBC with a random IV instead of ECB.