Skip to main content
1 of 7
Amit
  • 432
  • 3
  • 13

If for some reason you want to "force" AES-ECB to become CPA resistant, I guess the best option would be to insert one plaintext byte to each 16-byte block, and fill the other 15 bytes with Cryptographically strong random bytes. Remember, in CPA the attacker can obtain as many ciphertexts as he wants for any plaintext, so if you don't have enough random padding bytes he can easily exhaust the pad combinations and reveal whether a certain message was encrypted under the relevant key.

This would be a highly wasteful scheme, so I wouldn't recommend using it, apart from academic purposes, but I think it can be shown to be CPA secure. If your goals are practical rather than academic, as @MaartenBodewes already mentioned you are better off using a secure mode of operation like GCM.

Amit
  • 432
  • 3
  • 13