Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I took a look at this question. My question is not the same.

I've unique keys encrypting (in CBC mode, AES-256) each plaintext, i.e. I do not use a key to encrypt more than one plaintext. Is it insecure to use null IVs in this case? Why?

share|improve this question

2 Answers 2

up vote 18 down vote accepted

Caveat: as very rightly pointed in that other answer, using a fixed/no IV does make some attacks less difficult. I wish the following answer would have been less affirmative. I have accordingly made adjustments in italic.

There's no imperious need for an IV when unique keys are used.

When each key is used only to encipher a single message, it is reasonably safe (from a confidentiality standpoint) to use null IV for all messages. That's customary, for all common modes requiring an IV. It avoids the need to generate an IV, and transmit it, and (in the case of CBC) perform a XOR of the first block with it.

Why? Intuitively: random (or otherwise appropriate) IVs are primarily here to make it unlikely that the same input/output pairs (at the block cipher level, and using the same key) ever occurs during the encryption of two distinct messages, even when one bears some relation to the other (including but far from limited to: starting with the same first block). When there is a single message, that need disappears. More formally, the basic (non-quantitative) proof of security of CBC (and other secure modes) holds without IV when there is a single message per key.

On the other hand, by not using a random IV, in some setups, one gives the adversary the same plaintext block enciphered with different keys (that would be the case if the first block of each plaintext is a known constant); this reduces the number of trial encryptions for exhaustive key search by a factor (at worse) equal to the number of different keys.

Note: The single message per key setup leaves the total message length per key limit unchanged for CBC, PCBC, CFB: that's $2^{(b+1-k)/2}$ blocks for less than $2^{-k}$ odds of collision (implying some level of insecurity) using a $b$-bit block cipher. That limit is dramatically raised for OFB and CTR in the single message per key setup.

share|improve this answer
    
That's exactly what I was expecting. Thanks for the concise explanation. –  Ashwin Jun 6 '13 at 22:23

You should use random IV even when unique keys are used.

This prevents key-collision attack where the attacker collects number of cryptograms that have been encrypted with unique keys and brute-forces for key.

Using predictable IV will reduce security of your cryptosystem by a factor of N (where N is the number of ciphertexts created). The attack recovers one of the ciphertext (but the attacker cannot control which one).

https://eprint.iacr.org/2012/159.pdf

share|improve this answer
3  
It's more of a multi-target pre-image attack rather than a collision attack. Personally I'd only bother with IVs when they key has "only" 128 bits. For 256 bit keys even those multi target attacks are too far out of reach. –  CodesInChaos May 2 at 12:53
    
That's a VERY good point, I have altered my answer accordingly. I wish I had noticed that alternate answer long before! –  fgrieu Aug 25 at 18:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.