Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using PHP to encrypt a string and Java to decrypt it on a remote server. To perform the encryption, I'm using the strategy that can be found here.

My problem is that the strings I encrypt are pretty small and very similar each other. Nevertheless, I'd like a high degree of randomness in the encrypted values.

Just to be clear, at current this is what happens:

$$encrypt(foo1) \rightarrow barA$$ $$encrypt(foo2) \rightarrow barB$$

While I'd like something like:

$$encrypt(foo1) \rightarrow b3SA$$ $$encrypt(foo2) \rightarrow 4FrB$$

How can I enhance the randomness of the encrypted values, by keeping the algorithm I'm already using?

share|improve this question
I see that you're using an initialization vector. If that's sufficiently random, I believe you should be good. Padding to a specific size multiple may also be advisable. Change your IV for every message, of course. – Jeff Ferland Sep 28 '11 at 16:59
up vote 11 down vote accepted

If you are doing things right, then you will get the level of randomness you are after. Translation: you are not doing things right. You use AES with CFB8 mode, which requires a random initial value. The initial value is a 16-byte string which should be generated randomly and uniformly, and a new IV shall be generated for every single encrypted message. Since you need it for decryption, the IV for an encrypted message shall be stored/transmitted along with the said message.

Failure to use a new IV for each message results in a wide range of weaknesses, including what you are witnessing right now (if two strings begin with the same characters, the resulting encrypted strings will also begin with the same bytes).

share|improve this answer
At first, I didn't realize I could have passed the IV along with the message without losing in security. Thanks for clarifying this, it works perfectly now. – Roberto Aloi Sep 28 '11 at 18:47

protected by Ninefingers May 9 '12 at 8:52

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.