---
title: Avoid the insecure ECB cipher mode
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid the insecure ECB cipher mode
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid the insecure ECB cipher mode

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/insecure-cipher-mode`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [327](https://cwe.mitre.org/data/definitions/327.html)

**Related CWEs**:

- [328](https://cwe.mitre.org/data/definitions/328.html)
- [916](https://cwe.mitre.org/data/definitions/916.html)
- [1240](https://cwe.mitre.org/data/definitions/1240.html)

## Description{% #description %}

The Electronic Codebook (ECB) cipher mode encrypts each block of plaintext independently, so identical plaintext blocks always produce identical ciphertext blocks. This leaks structural information about the data and can allow an attacker to detect patterns, reorder blocks, or recover information without breaking the underlying cipher.

This covers the `encrypt` package (`AESMode.ecb`) as well as `pointycastle` (`ECBBlockCipher`, or a `BlockCipher('AES/ECB')`-style factory string).

Replace ECB with an authenticated mode such as GCM (`AESMode.gcm` / `GCMBlockCipher`), or another secure mode like CBC or CTR combined with a unique IV per encryption.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
import 'package:encrypt/encrypt.dart';
import 'package:pointycastle/export.dart';

Encrypter inlineEncrypter(Key key) {
  return Encrypter(AES(key, mode: AESMode.ecb));
}

AESMode insecureMode() {
  final mode = AESMode.ecb;
  return mode;
}

BlockCipher pointyEcbClass() {
  return ECBBlockCipher(AESEngine());
}

BlockCipher pointyEcbFactory() {
  return BlockCipher('AES/ECB/PKCS7');
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
import 'package:encrypt/encrypt.dart';
import 'package:pointycastle/export.dart';

Encrypter gcmEncrypter(Key key) {
  return Encrypter(AES(key, mode: AESMode.gcm));
}

Encrypter cbcEncrypter(Key key) {
  return Encrypter(AES(key, mode: AESMode.cbc));
}

AESMode secureMode() {
  final mode = AESMode.ctr;
  return mode;
}

BlockCipher securePointy() {
  final gcm = GCMBlockCipher(AESEngine());
  final cbc = CBCBlockCipher(AESEngine());
  return cbc;
}

BlockCipher secureFactory() {
  return BlockCipher('AES/CBC/PKCS7');
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}