Cipher With ECB Mode Should Not Be Used
<p>I am trying to use a <code>Cipher</code> with an RSA key pair along with the <code>&quot;AndroidKeyStore&quot;</code>. In all of the Android documentation I can find, the examples show <a href="http://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.html" rel="noreferrer"><code>Cipher.getInstance(&quot;RSA/ECB/OAEPWithSHA-256AndMGF1Padding&quot;)</code></a> or <a href="http://developer.android.com/reference/android/security/keystore/KeyProtection.html" rel="noreferrer"><code>Cipher.getInstance(&quot;RSA/ECB/PKCS1Padding&quot;)</code></a>. Both of which come up with the same warning on Android Studio:</p>
<blockquote>
<p>ECB Encryption should not be used</p>
<p>Cipher#getInstance should not be called with ECB as the cipher mode or without setting the cipher mode because the default mode on android is ECB, which is insecure.</p>
</blockquote>
<p>Obviously I cannot omit it, or set the mode to <code>None</code>, because the default is ECB. If ECB mode is insecure, which mode should I be using?</p>
<p>If I use any other mode (that I know of) I get a <code>NoSuchAlgorithmException: No provider found for RSA/{mode}/OAEPWithSHA-256AndMGF1Padding</code>. Could the padding be the problem?</p>
<p>Either way, according to the <a href="http://developer.android.com/training/articles/keystore.html" rel="noreferrer">Android KeyStore System</a> documentation, ECB mode seems to be the only cipher block mode that it supports while using RSA.</p>