For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/insecure-cipher-mode.md. A documentation index is available at /llms.txt.

Avoid the insecure ECB cipher mode

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/insecure-cipher-mode

Language: Dart

Severity: Warning

Category: Security

CWE: 327

Related CWEs:

Description

The Electronic Codebook (ECB) cipher mode encrypts each block of plaintext independently, so identical plaintext blocks always produce identical ciphertext blocks. This leaks structural information about the data and can allow an attacker to detect patterns, reorder blocks, or recover information without breaking the underlying cipher.

This covers the encrypt package (AESMode.ecb) as well as pointycastle (ECBBlockCipher, or a BlockCipher('AES/ECB')-style factory string).

Replace ECB with an authenticated mode such as GCM (AESMode.gcm / GCMBlockCipher), or another secure mode like CBC or CTR combined with a unique IV per encryption.

Non-Compliant Code Examples

import 'package:encrypt/encrypt.dart';
import 'package:pointycastle/export.dart';

Encrypter inlineEncrypter(Key key) {
  return Encrypter(AES(key, mode: AESMode.ecb));
}

AESMode insecureMode() {
  final mode = AESMode.ecb;
  return mode;
}

BlockCipher pointyEcbClass() {
  return ECBBlockCipher(AESEngine());
}

BlockCipher pointyEcbFactory() {
  return BlockCipher('AES/ECB/PKCS7');
}

Compliant Code Examples

import 'package:encrypt/encrypt.dart';
import 'package:pointycastle/export.dart';

Encrypter gcmEncrypter(Key key) {
  return Encrypter(AES(key, mode: AESMode.gcm));
}

Encrypter cbcEncrypter(Key key) {
  return Encrypter(AES(key, mode: AESMode.cbc));
}

AESMode secureMode() {
  final mode = AESMode.ctr;
  return mode;
}

BlockCipher securePointy() {
  final gcm = GCMBlockCipher(AESEngine());
  final cbc = CBCBlockCipher(AESEngine());
  return cbc;
}

BlockCipher secureFactory() {
  return BlockCipher('AES/CBC/PKCS7');
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security

Datadog Code Security