Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus seems to be that our application should be FIPS 140-2 compliant if we use a FIPS certified library.

We are using the AES algorithm from a FIPS certified library — iOS commoncrypto — for the encryption of database and disk files. We generate a key dynamically based on a random salt for each encryption of a file (CBC mode, same key for different block of same file). However, we don't use any initialization vector.

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

share|improve this question
1  
If I'm reading your question right, regardless of your FIPS-compliance, if you are independently encrypting multiple blocks of a file with the same key and no (e.g., all zeroes) IV, you have a potentially severe weakness in your security architecture. –  Stephen Touset Oct 10 '13 at 22:44
    
thanks @StephenTouset. we are not independently encrypting multiple blocks of same file, rather we are using CCryptorCreate to create a cryptor and then use CCryptorUpdate to update the crpytor with more data (32 K bytes every update). Here is the API: developer.apple.com/library/ios/documentation/System/Conceptual/… –  windfly2006 Oct 11 '13 at 0:36
2  
    
@Stephen Touset: Why would there be any weakness? Read "We generate a key dynamically based on a random salt for each encryption" in the question's statement. Note: I pass on answering the question, which is about a regulatory requirement. –  fgrieu Oct 11 '13 at 6:47
1  
@fgrieu The statement "CBC mode, same key for different block of same file" could have been interpreted as encrypting each block independently with the same key in CBC mode, or encrypting the whole file at one time in CBC mode. If the former, very bad. If the latter, fine (at least, within the scope of CBC mode). –  Stephen Touset Oct 12 '13 at 1:14
show 1 more comment

2 Answers

up vote 1 down vote accepted

Foreword

atsec IT security blog recently commented about FIPS and NIST rules with: "As technology moves on, and the pace of change increases, with no real update to the specification for a decade, FIPS 140-2 is creaking badly. To deal with this, the CMVP must issue Implementation Guidance (I.G.), which is now so complex that it is virtually impossible to understand all the nuances. We saw several presentations on the topic of several notorious implementation guidances, and even some more formal logical analysis of the I.G. themselves."

So, do not expect anybody else than CMVP to be able to guide you in this. They are supposedly the ones to decide what are the approved and allowed ways. (But you need to wait until the government shutdown ends.)

Answer

If I interpret 'without IV' very strictly, I would recommend to use ECB mode (like Mr. Stone) or maybe AES KW. AES-GCM likely does not do because of A.5.

The OP mentioned CBC mode. There is no CBC without IV, so I interpret his question to mean CBC mode, with zero IV or some other static IV.

If each file uses different key, it should be fairly ok to use static IV. However, NIST SP 800-38A (document describing basic cipher modes of operation) has two allowed ways of creating CBC mode IV, random and usage of approved cipher. Therefore, if the target is to be FIPS 140-2 compliant (which includes compliance with NIST SP 800-38A), it is likely more secure to use one of these mechanisms.

If you already generate keys randomly, I would think you could also generate random IV? Then you would be most likely compliant with the recommendation.

Alternatives

It was discussed above that it may not be recommendable to use all zeroes for CBC, but using start IV/nonce/counter of all zeroes could be OK for these modes: CTR, GCM, CCM -- assuming the key/IV pair is not reused. Maybe one of these would meet your needs?

share|improve this answer
    
thanks. Yes, we are using all zero IVs with CBC mode. Question about your point "It was discussed above that it may not be recommendable to use all zeroes for CBC", if we are using different key for encryption of different file with CBC mode, based on some above comment (@fgrieu and @Stephen Touset), it should not be an issue, right? Or am I missing something. –  windfly2006 Oct 15 '13 at 17:51
    
@windfly2006 From perspective of security it may be alright. The item you're missing is that the requirements for FIPS 140-2 approved implementations are given in NIST's SP 800-XXX and FIPS XXX documents. The appropriate guidance for use of AES-CBC mode is given in NIST SP 800-38A document. This document describes allowed ways of generating IV for CBC (which you must follow in case you want to claim FIPS 140-2 compliance). All zero IV would not be strictly compliant of the IV generation alternatives given in this document. Thus, read the document and consider yourself. –  user4982 Oct 15 '13 at 18:40
    
Quote from the NIST SP 800-38A doc, App C: "There are two recommended methods for generating unpredictable IVs. The first method is to apply the forward cipher function, under the same key that is used for the encryption of the plaintext, to a nonce. The nonce must be a data block that is unique to each execution of the encryption operation." Depending on your interpretation and data, it is can be seen that static IV can be actually compatible with the definition. In case static IV is used in way that would fail compatibility with this definition, then you need to use random IV instead. –  user4982 Oct 15 '13 at 18:57
    
thanks @user4982, very useful information. –  windfly2006 Oct 16 '13 at 1:36
add comment

No you don't need to use an IV. However, this limits you to ECB mode only — the only one which doesn't use an IV — and your CAVP (Cryptographic Algorithm Validation Program) AES certificate will indicate so.

share|improve this answer
    
Actually, I believe that it would be legal to use GCM will an empty (zero length) IV. Now, that means that you can't encrypt two different messages with the same key; windfly2006 already states that they abide by that restriction. –  poncho Oct 11 '13 at 15:03
    
FIPS 140-2 Implementation Guidance section "A.5 Key/IV Pair Uniqueness Requirements from SP 800-38D" states "the IV length shall be at least 96 bits (per SP 800-38D)" (if internally generated by the module). –  Mr. Stone Oct 11 '13 at 15:11
    
However, a zero length IV would not be "internally generated by the module". I'm not positive that this would pedantically meet the requirements; however FIPS does appear to allow zero length IVs (at least, that option does appear on the Algorithm Information Sheet; the "Other IV lengths supported" range does go down to 0) –  poncho Oct 11 '13 at 15:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.