Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am a bit confused about the use of IV, and key hash.

Is the key hash and IV stored inside the headers of the cipher text?

Isn't it a security risk to store this header information?

By key hash I mean the hash of key is stored inside the headers. It seems that when I use gpg or OpenSSL , the header of cipher text has encoded method and Iv and hash of key (if I am using a pass phrase )

share|improve this question
    
If by key hash you mean the actual key, then no, of course it can't be transmitted and/or stored with the ciphertext. If that's not what you mean then please clarify. The IV, however, can be stored/transmitted with the ciphertext, as it's not required to be secret. You might find a few minutes on wikipedia enlightening. –  hunter Jul 11 '13 at 11:36
    
@hunter I am confident he means the hash of a (cryptographically secure) key, which can be securely disclosed, though it could be clarified. –  Thomas Jul 12 '13 at 10:58
    
@Thomas if that's the case, then sure, although I don't think it's good practise. The only reason I can think of to store the hash of a key with ciphertext would be to verify a correct key at decryption time. However, if the encryption is authenticated (which it should be) either by a dedicated AEAD mode, or with a MAC, then a hash of the key seems redundant. Does storing a hash of the key with ciphertext serve some other purpose? –  hunter Jul 12 '13 at 13:11
    
@hunter It lets you verify you have the correct key before attempting to process a (potentially large) ciphertext message. There is also a MAC or an AEAD tag, of course, but it cannot be verified until the whole file has been acknowledged. This makes no sense in an interactive protocol, but for encryption at rest it is perfectly standard practice (though typically in those situations the key is derived from a password, so you also need a KDF + salt). –  Thomas Jul 13 '13 at 3:11
1  
You are correct that it is theoretically redundant, but sometimes you need to know if the key is the right one before proceeding to decrypt and authenticate perhaps gigabytes of data, possibly overwriting the existing ciphertext in the process. –  Thomas Jul 13 '13 at 3:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.