YanoSec
Progress0 of 152 lessons complete

Course / 10 Crypto and files / Lesson 05 of 19

Block ciphers and the ECB picture

Estimated time: 15 min reading · 15 min activity

A block cipher transforms a fixed-size block of input bytes under a key. A mode specifies how to apply that block operation to a message. ECB, Electronic Codebook, treats each complete block independently under the same key, so equal input blocks follow the same mapping.

Plaintext is the original message and ciphertext is its transformed representation. The labels below model block equality only. They are not encrypted bytes, a key or output from AES, a real block-cipher algorithm. Their purpose is to make a visible pattern easy to count.

Before you begin

Estimated time
15 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Read the printed evidence in a desktop or mobile browser and keep notes on paper or in a text editor. No installation, recovery tool, GPU, real password, live lookup or external account is required. Any later optional tool setup is outside the estimates.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • Point at a repeated plaintext block and its repeated ciphertext label.
  • Count how many times that ciphertext label appears.
  • Keep the toy labels separate from a production cipher and from a mode's extra inputs.

01Example

Original block-equality diagram. Each repeated label represents one complete block.

Plaintext blocks: AA AA BB
ECB output labels: XX XX YY
AA maps to XX in both positions under this single key.
The labels show equality; they do not reveal actual cipher bytes.

02The mode is the repetition rule

The key must stay the same for this equality comparison. ECB applies the same block transformation without carrying a changing value from a preceding block. Repetition can therefore remain visible even when the output bytes themselves are unreadable.

Other modes use different rules; their names alone do not explain those rules. The cited publication describes confidentiality modes, which concern concealing content. Integrity and authenticity—detecting alteration and establishing a trusted source—need suitable additional protection or an appropriate authenticated construction. This toy diagram provides neither.

Recognize repeated blocks under a fixed ECB mapping and distinguish a mode from a cipher.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Playback is optional. Step through at your own pace.

Supplied teaching sample

Plaintext positions

AAposition 1
AAposition 2
BBposition 3

ECB equality labels

XXposition 1 equality labelLabels show equality, not actual cipher bytes.
XXposition 2 equality label
YYposition 3 equality label

AA → XXAA → XX under the one key

AA → XXEqual AA → equal XX

The repeated AA blocks map to repeated XX labels under this single key.

Follow the explanation

  1. The repeated AA blocks map to repeated XX labels under this single key.
  2. The third position retains its own BB-to-YY correspondence.
Read every state and value

1. The repeated AA blocks map to repeated XX labels under this single key.

Example
Supplied teaching sample
Visible Item
AA · AA · BB · XX · XX · YY
Current mappings
AA → XX under the one key · Equal AA → equal XX
Annotations
Item: XX; Text: Labels show equality, not actual cipher bytes.

2. The third position retains its own BB-to-YY correspondence.

Example
Supplied teaching sample
Visible Item
AA · AA · BB · XX · XX · YY
Current mappings
BB → YY equality label
Annotations
Item: YY; Text: No encryption library or padding is represented.
The diagram reveals equality across full blocks, not actual cipher bytes; mode and cipher are different concepts.

03Count the activity label

The activity row uses fresh block labels QQ RR QQ. Read the diagram or the identical text table.

Label: toy block labels. Not AES output. No cipher program was run.
ECB, under one key, assigns one ciphertext label to each plaintext block.
The same plaintext label keeps the same ciphertext label.

Worked plaintext blocks: AA AA BB
Worked ciphertext labels: XX XX YY
XX appears twice.

Activity plaintext blocks: QQ RR QQ
Activity ciphertext labels: 11 22 11
Predicted: the label 11 appears twice.

Download the block table

Repeated blocks retain a visible pattern
Repeated blocks retain a visible patternModel. A teaching model drawn by hand. It shows the idea, not real tool output.The plaintext blocks QQ, RR, QQ are processed separately under one fixed key. Their output labels are 11, 22, 11. Equal input blocks give equal output blocks in this ECB model. The short labels are invented examples, not computed ciphertext or a full encryption algorithm.

Equal blocks give equal output

  1. Find the two positions containing QQ in the plaintext row.
  2. Read the corresponding output row 11 22 11 and count the label 11. Your prediction should be two occurrences.
  3. Explain why counting matching blocks reveals a pattern but does not recover a key or the actual plaintext bytes.
  4. Stop with that interpretation. No encryption program or image-encryption demo is required.

04Optional challenge

For about ten optional minutes, imagine that the third plaintext block changes to a new label SS under the same mapping. Draw an output row with a distinct label for SS and explain which previous repetition disappears. Keep the labels explicitly marked as a model.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Block card A: fresh one-key equality modelOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

This is an ECB equality-label model, not actual encrypted bytes.
For one fixed key: block P maps to label ab; Q to cd; R to ef.
Plaintext sequence: P Q P R P. Each symbol denotes one complete same-sized block.

Changed block card B: independent sequenceOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Same fixed-key mapping: L→31, M→42, N→53.
Before: L M L.
Change only the third block to N. No key change is made.

06Explain the evidence and its limit

Optional self-check: draw a repeated complete-block sequence and a version with one block changed.

Review it: hold the key fixed, preserve independent position mappings, mark the invented labels as a model and distinguish confidentiality from integrity and authenticity.

07Common mistakes

If you read 11 as an actual encrypted byte, return to the caption: these are equality labels, not AES output.

If the mapping changes between repeated blocks, you have changed the stated one-key ECB model.

If confidentiality is taken to imply authenticity, separate hiding the contents from detecting modification or proving a trusted origin.

References

  • NIST SP 800-38A

    Section 6.1 defines ECB’s independent per-block transformation; the publication concerns confidentiality modes.

  • NIST SP 800-38A DOI

    Section 6.1 defines ECB’s independent per-block transformation; the publication concerns confidentiality modes.