Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 5 down vote favorite
1

I just learned that using CBC encryption with an IV which is predictable is not secure.

From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can verify if the IV he guessed was right. How does this qualify as an attack?

share|improve this question

1 Answer

up vote 6 down vote

The CBC IV attack does more than that.

If I guess the plaintext corresponding to any ciphertext block I've seen before, and can predict a future IV, I can verify my guess by submitting a suitable message to be encrypted with that IV. Obviously, that could be bad if, say, I knew the plaintext to be either "yes" or "no", and only needed to find out which one it is.

More concretely, the BEAST attack for example allows the recovery of cookies sent by a web browser over HTTPS. The way it works is (more or less) that you first convince the browser to send an HTTPS request where a block boundary falls just after the first unknown byte in the cookie (e.g. by adjusting the length of the requested URL) and intercept the ciphertext.

So now you have a ciphertext block that you know corresponds to, say, the string Cookie: secret=X, where X is an unknown byte. Now you use the CBC IV attack to test all possible values of X and find the right one. Then you repeat the process with a URL that's one byte shorter, so that you get a ciphertext block corresponding to ookie: secret=XY, where you now know X but don't yet know Y. Then just keep repeating the process until you've recovered the entire cookie, byte by byte.

See this answer to a related question for more details.

share|improve this answer
So, aren't there 2 necessary conditions here ? 1. You are able to predict the next IV ( quite possible reading the BEAST attack with SSL) and 2. You guess the ciphertext block of a previously received message. Is the latter always possible ? – asudhak Sep 27 '12 at 13:34
Not always, but more often than you'd think. See my edit above for a practical example. – Ilmari Karonen Sep 27 '12 at 13:57
1  
@asudhak: we typically assume that the attacker can see ciphertext. If he can't, then why are we encrypting at all? – poncho Sep 27 '12 at 14:05
oh no, I meant knowing that a specific block of plain text corresponds to a cipher text. That was clarified by the last edit. – asudhak Sep 27 '12 at 18:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.