Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be changed (probably forever).

Is it secure if the hash value of the key is used as the IV?

Update: The key is computer generated. The user of the program have no access to the key since it's obtained by the program via secure Web API. The user can only edit a portion of data stored in the file via the program.

share|improve this question
    
Welcome to crypto; your question was migrated here by the SO mods as it is a better fit here. Feel free to register here to receive notification of your responses :) –  Ninefingers May 23 '12 at 9:51
add comment

migrated from stackoverflow.com May 23 '12 at 9:49

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 5 down vote accepted

No, it is not secure.

From NIST 800-38:

The OFB mode requires a unique IV for every message that is ever encrypted
under the given key. If, contrary to this requirement, the same IV is used
for the encryption of more than one message, then the confidentiality of
those messages may be compromised 

Given your description, you are apparently safe, because at any one time you have one file only.

However:

  • A malicious user may store away an earlier version of the file and do a comparison after a change and learn which bits flipped in the first block where that happened.
  • In the future, you may add a second file and not remember the rule above.

A unique (not necessarily truly random) IV per message is still recommended.

share|improve this answer
    
A solution to this is to store a random IV in the file header, xor'ed with the hash of the password. When you decrypt, compute the password hash and xor against the stored value, then use the result as the IV. This gives you a safe way to store the IV, and a unique IV per file. –  Polynomial May 23 '12 at 9:59
    
@Polynomial Why xor the IV with the password hash? Sounds dubious to me. –  CodesInChaos May 23 '12 at 10:34
    
@CodeInChaos It's not intended to be some hair-brained "increase the entropies!" scheme, if that's what you're concerned about. The idea is to xor the IV with the hash when storing it in the file, so it can't be known by an attacker without knowing the password. –  Polynomial May 23 '12 at 10:39
1  
@Polynomial: For OFB (and in general), the initialization vector doesn't have to be secret (as it will be passed through the cipher before being used). –  Paŭlo Ebermann May 23 '12 at 17:58
    
What about other modes like CBC, ECB and CFB? Do they share the same problem? –  Lacek May 24 '12 at 2:01
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.