Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve randomness between messages. If the IV is simple appended, or prepended to the plain text, why does AES need to know the IV to decrypt it? Can't it just decrypt it, drop the first x amount of bytes and then it has the original plaintext or does AES do some special jizz-jazz with the first bytes in the stream?

share|improve this question
This can pretty much be answered trivially by reading the relevant Wikipedia article. Note that attempting decryption without the IV is the logical equivalent of trying to compare a password against a salted hash, without having access to the salt. – Stephen Touset Apr 8 '13 at 5:50
I never understood exactly what CBC was doing tho. Did it take the unencrypted previous block as the IV for the next, or the encrypted previous block as the IV for the next? – jduncanator Apr 8 '13 at 5:52
In fact that Wikipedia article confirms what I said. If the IV is the same length, and is prepended or appended to the plaintext, then you could simply strip those bytes off the end or from the front after decryption. The only reason the decryptor needs the IV (by the looks of that article) is to know what bytes to strip! – jduncanator Apr 8 '13 at 5:54
Look at the images. The previous ciphertext block is always used as the "IV" for the next block, both during encryption and decryption. The initialization vector acts as the first "previous block" when none would otherwise be there. – Stephen Touset Apr 8 '13 at 5:54
The IV is not prepended to the plaintext. It is XORed against the plaintext block, as the second sentence in that section clearly states. When you decrypt the first ciphertext block, you now have a message that was XORed against the IV; good luck retrieving the original message if the IV is unknown. – Stephen Touset Apr 8 '13 at 5:55
up vote 9 down vote accepted

The initialization vector is XORed against the first plaintext block before encryption in CBC mode, as shown in the Wikipedia article on block cipher modes. After the first block is decrypted, you still have an intermediate value which has been XORed with the plaintext — without this, you have little hope of recovering the plaintext. However, you do not need the IV to decrypt subsequent blocks.

You could perform CBC in a way that would remove the need to know the initialization vector (note: this is not recommended or encouraged, just pointing it out for the novelty). If you use a null IV and use a random value for the first block of plaintext, you can discard this value and only transmit the ciphertext. Note that this actually gains you nothing, because now the ciphertext is one whole block longer!

share|improve this answer
The only problem with using a null IV and and random value for the first block of plain text, if done consistently, is that you get one extra unnecessary block cipher operation. The end result is indistinguishable from using a random block as the first cipher text block. – Henrick Hellström Apr 8 '13 at 7:11
In effect the XOR of the first random block with null (ie the first random block) becomes your IV. – Aron Aug 12 '15 at 3:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.