# Encrypting (CBC) identical files with same key and different iv, is it less secure?

Let's say you encrypt multiple files with CBC encryption using the same key, but each file has unique (and pseudo random) iv. Does this weakens the security of the data? Is it easier to obtain key if you have many instances of the same data encoded with different iv. Let's assume that the attacker knows all the files are the same or at least partially (first half) the same.

-

You don't need to worry. There is no known weakness in CBC mode or AES which would mean that encrypting identical files (with different initialization vectors) makes it easier to retrieve the key, or decrypt the data.

The different initialization vector for CBC makes it sure that even the same file results in different input to the block cipher, and thus different output, so an attacker doesn't even know that these two ciphertexts are the same file (other than for the file size).

To crack AES, now the best known method is to try different keys and encrypt or decrypt one block with each, and compare the output with either captured ciphertext or known (or "guessed") plaintext (where we take the IV or previous block into account), until one matches. (For keys bigger than 128 bit, we might need to check with a second block.) If we don't know anything about the plaintext (which is quite rare, but might occur when encrypting a key), this doesn't work - and here our "twice the same file" can help:

• decrypt the same block of both files
• XOR each with the previous block each (or the IV in case of the first block)
• compare.

This needs about twice the work as an ordinary known-plaintext attack, though, which is already out of any realistic ability to crack, if the key space isn't somehow reduced, i.e. if the key is generated from a password.

Note that there is a "weakness" in CBC which says that the total number of blocks to be encrypted with each key should be limited to about $2^{n/2}$, where $n$ is the block size in bits, to make the probability of repeated outputs (and thus repeated XOR-masks for the next block) neglectible. This doesn't really depend on encrypting the same or different files, though, and for 128-bit blocks, this number is quite high ($2^{68}$ bytes, around 200 exabytes, which is half of the world's total digital content (of 2009)).

-
Thank you for your answer. What if the attacker has more than 2 identical files (just different iv), lets say N. Is there a relation between N and chances that data can be decrypted. –  Ben Nov 8 '11 at 16:54
As long as your N times the size of your file remains small compared to the $2^{68}$ bytes I mentioned in the last paragraph, the chance to get anything out of the ciphertext remains negligible. –  Paŭlo Ebermann Nov 8 '11 at 17:03