The ECB mode and its flaw (the penguin)

Knowing how to split and pad a message still does not tell us how to chain the blocks together. This choice is called an operating mode, and the most naive of them, the ECB mode, is a perfect illustration of why it deserves careful thought.

The ECB mode

ECB stands for Electronic Code Book. Its principle is as direct as can be: each plaintext block is encrypted independently of the others, with the same key.

bloc clair 1 --[ AES, clé K ]--> bloc chiffré 1
bloc clair 2 --[ AES, clé K ]--> bloc chiffré 2
bloc clair 3 --[ AES, clé K ]--> bloc chiffré 3

Simple, parallelizable, with no state to remember. And yet, it is a security disaster.

The fundamental flaw

Since the encryption is deterministic and memoryless, two identical plaintext blocks produce two identical ciphertext blocks:

clair : ...  [ATTAQUE_A_MIDI] ... [ATTAQUE_A_MIDI] ...
              |                     |
              v                     v
chiffré: ...  [ 8F3A...C1 ]  ... [ 8F3A...C1 ] ...
              \_____________________/
               blocs identiques : la répétition FUIT

The attacker does not know the key, but they can see that two regions of the message are identical. The structure, the repetitions, the patterns of the plaintext show through in the ciphertext.

The penguin that revealed everything

The now-famous illustration is that of an image of the penguin Tux, the Linux mascot. We encrypt the image, pixel by pixel, with ECB mode.

Image originale        Chiffrée en ECB
+---------------+      +---------------+
|    (Tux)      |      |  ~~pingouin~~ |
|   _____       |      |  ::: bruit :::|
|  / o o \      |      |  encore       |
|  \  ^  /      |      |  reconnaissable
|   \___/       |      |  !!!!!        |
+---------------+      +---------------+

The result is astonishing: the penguin is still recognizable. The large areas of uniform color (identical blocks) yield identical ciphertext blocks, so the outlines remain perfectly visible. The encryption has masked only the noise, not the shape.

The lesson

A good cipher must produce output that looks like randomness, with no visible link to the plaintext. ECB fails this elementary test: it encrypts the data, but leaks its structure.

Propriété	Ce que fait ECB
Identical blocks	-> identical ciphertexts
Plaintext patterns	visible in the ciphertext
Deterministic	yes (no randomness)
Recommended	never

In summary

• ECB encrypts each block independently with the same key.
• Two identical plaintext blocks give two identical ciphertexts: the message structure leaks.
• The Tux penguin encrypted in ECB remains recognizable: visual proof of the flaw.
• ECB must never be used for real content; a mode that breaks this regularity is needed.