I am developing on a platform where my only encryption option uses AES ECB. The encryption is used to protect parameters that the user can set, and so it susceptible to a chosen plaintext attack. It's not a cookie, but similar; the user enters credentials, which with other data is sent to the server for authentication and authorisation.
What steps can I take to make the chosen plaintext attack impractical?
Specifically, my current proposed mitigation is to add random "fill" before and after my meaningful content. The encrypted blob will look roughly the same length, but the place where the ciphertext from the chosen plaintext appears will be different for each call. At this point the communications are low volume, so I am less worried about the efficiency, size or processing time of the data. Is this an effective mitigation?
Alternately I could consider randomising the order of the fields (the plaintext is JSON). That's a bit harder to implement. Would this make the attack impractical?
I have read and think I understand this great question and answer.