ECB vs CBC for encrypting high entropy data I have a master AES key and I need to encrypt other AES keys with this key. Is ECB safe to encrypt highly random data (a key)? What benefit would I get if I use CBC instead?

In particular, are the following methods secure, which one is more secure and why:


AES-ECB(random_data)
AES-CBC(random_data, iv = zero)
AES-CBC(random_data, iv = random)
ECB is fine for encrypting random data. The point of ECB is that it is secure as long as the input of the blocks isn't repeated. It's often used as a key wrapping method which seems to be your use case.

Note that ECB mode is often used incorrectly even for key wrapping. For instance because the key is embedded in a structure (e.g. PKCS#1 encoded RSA keys). In that case ECB mode may leak data not just about the structure but also about the key.

You can still get into trouble even when wrapping AES keys as neither ECB nor CBC is an authenticated cipher. So if an attacker is able to change the encrypted value you're in trouble. Padding oracles may also apply - so don't unpad an AES-192 bit key (which uses 1.5 blocks!).



Basically you could be OK with any option you mention - but it depends on the system as a whole. I would still choose CBC with a random IV, if just to be on the safe side. That is, if the above are the only options you have, there are better alternatives (e.g. key wrapping mode - first mentioned by Louis Casillas - or SIV mode).