# Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at this question. My question is not the same.

I've unique keys encrypting (in CBC mode, AES-256) each plaintext, i.e. I do not use a key to encrypt more than one plaintext. Is it insecure to use null IVs in this case? Why?

-
–  Jeremy Banks Jun 7 '13 at 20:51

There's no need for an IV when unique keys are used.

When each key is used only to encipher a single message, it is safe (from a confidentiality standpoint) to use null IV for all messages. That's customary, for all common modes requiring an IV. It avoids the need to generate an IV, and transmit it, and (in the case of CBC) perform a XOR of the first block with it.

Why? Intuitively: random (or otherwise appropriate) IVs are here to make it unlikely that the same input/output pairs (at the block cipher level, and using the same key) ever occurs during the encryption of two distinct messages, even when one bears some relation to the other (including but far from limited to: starting with the same first block). When there is a single message, that need disappears. More formally, the proof of security of CBC (and other secure modes) holds without IV when there is a single message.

Note: The single message per key setup leaves the total message length per key limit unchanged for CBC, PCBC, CFB: that's $2^{(b+1-k)/2}$ blocks for less than $2^{-k}$ odds of collision (implying some level of insecurity) using a $b$-bit block cipher. That limit is dramatically raised for OFB and CTR in the single message per key setup.

-
That's exactly what I was expecting. Thanks for the concise explanation. –  Ashwin Jun 6 '13 at 22:23

You should use random IV even when unique keys are used.

This prevents key-collision attack where the attacker collects number of cryptograms that have been encrypted with unique keys and brute-forces for key.

Using predictable IV will reduce security of your cryptosystem by a factor of N (where N is the number of ciphertexts created). The attack recovers one of the ciphertext (but the attacker cannot control which one).

https://eprint.iacr.org/2012/159.pdf

-
It's more of a multi-target pre-image attack rather than a collision attack. Personally I'd only bother with IVs when they key has "only" 128 bits. For 256 bit keys even those multi target attacks are too far out of reach. –  CodesInChaos May 2 at 12:53