Is ECB mode secure if plaintexts are guaranteed to be unique? I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few bits.

In this scenario, is ECB secure?
Yes, this is one case where ECB mode is secure.

It can be shown to be secure trivially from the indistinguishability assumptions of AES; that AES with an unknown key cannot be distinguished from a random permutation.  If the plaintexts are all 16 bytes long, then in ECB mode, this directly means that the ECB mode encryption of those plaintexts are indistinguishable from random.

I'm sure MrNerdHair already knows this, but for those people who may be reading this later, lets make this a bit more explicit.  The assumptions that I am making are:


Every plaintext message is 16 bytes (either they're all 16 bytes, or they are all less than 16 bytes and become 16 bytes after padding).  If the message is longer (and so ECB mode does two separate encryptions), the attacker may be able to take advantage of the lack of interaction between those two blocks
Every plaintext message is distinct.  This matters because ECB mode encryption is determanistic, and so if we encrypt the same message twice, the ciphertexts will be exactly the same; this may be exploitable.