docs: add NIST SP 800-38G comment explaining AES-ECB usage in FPE

Author: lgutschow

src/FF1.php

@@ -72,6 +72,8 @@ private function fromDigits(array $d): string
 
     private function aesEcb(string $block): string
     {
+        // NIST SP 800-38G requires AES-ECB as the PRF for FF1/FF3 Feistel rounds.
+        // This is single-block encryption used as a building block, not ECB mode applied to user data.
         $algo = match (strlen($this->key)) {
             16 => 'aes-128-ecb',
             24 => 'aes-192-ecb',

src/FF3.php

@@ -76,6 +76,8 @@ private function fromDigits(array $d): string
 
     private function aesEcb(string $block): string
     {
+        // NIST SP 800-38G requires AES-ECB as the PRF for FF1/FF3 Feistel rounds.
+        // This is single-block encryption used as a building block, not ECB mode applied to user data.
         $algo = match (strlen($this->key)) {
             16 => 'aes-128-ecb',
             24 => 'aes-192-ecb',