Key recovery when AES ECB is used for short but repeated messages My question is based on the specification of the protocol LoRaWAN and especially on the part 6.2.5 Join-accept message.

It is said that the join-accept message is encrypted using AES ECB. This is (normally) a single message created like that:

aes128_decrypt(AppKey, AppNonce | NetID | DevAddr | RFU | RxDelay | CFList | MIC)


Imagine that an attacker can listen the communications. He doesn't know AppKey (obviously), AppNonce and of course the MIC. If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey using the flaws in AES ECB?

Disclaimer: sorry if I'm not clear, cryptography is not my speciality.
If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey using the flaws in AES ECB?


No. ECB is flawed, but not that flawed.

At worst the attacker can know the encryption of a message if they have already seen the same message encrypted. (Or decrypted, as the case may be - LoRaWAN uses the decryption direction here to avoid having to implement both directions in the end-device.)

That can still lead to attacks, but key recovery is not possible.