Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

learn more… | top users | synonyms

46
votes
7answers
52k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better? Edit: This question was asked long back when I was ...
27
votes
1answer
20k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and seen code ...
19
votes
2answers
4k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same. I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
15
votes
5answers
4k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
15
votes
3answers
1k views

Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
15
votes
1answer
3k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
14
votes
1answer
7k views

Compare Blockmode CBC (with diffuser) against XTS

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
12
votes
2answers
15k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
11
votes
2answers
4k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
11
votes
3answers
2k views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
11
votes
1answer
7k views

How do I correctly derive a Key and IV?

Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class). This encryption code will be used in conjunction with existing ...
10
votes
1answer
18k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
10
votes
1answer
7k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
10
votes
3answers
1k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
10
votes
2answers
6k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
9
votes
3answers
3k views

Relative merits of AES ECB and CBC modes for securing data at rest

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ...
8
votes
1answer
5k views

What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?

I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key. How serious is this weakness? Also, is AES less effected ...
8
votes
1answer
615 views

Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
8
votes
2answers
976 views

Is the 64-bit blocksize a fatal issue when encrypting TBs of data with Blowfish CBC?

Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the password,...
7
votes
2answers
1k views

Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode

I was not able to understand why we practically need a CPA security in Cipher Block Chaining. (which insist on having a random IV), let say if the encryption is not CPA secure i.e , the adversary can ...
7
votes
2answers
1k views

Strength of CBC with Ciphertext Stealing

Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7? I would imagine the most common situation where CTS is necessary would be due to some size constraint of ...
7
votes
1answer
720 views

CBC key lifetime, or, “how big is too big?”

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
6
votes
1answer
2k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
6
votes
1answer
1k views

What causes first block of AES decryption to be garbled, even with correct IV?

I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server. The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA ...
6
votes
1answer
1k views

What are the constraints for an IV using AES in CBC mode?

I'm designing a protocol for use into a VPN software. The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
6
votes
1answer
175 views

Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?

As I'm using HMAC to ensure integrity and authenticity of the ciphertext, is there any additional security benefit to verifying PKCS#7 padding when decrypting using AES CBC? A previous question asked ...
5
votes
2answers
3k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
5
votes
3answers
2k views

Difference between a nonce and IV

I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
5
votes
4answers
1k views

Security proofs for CBC mode

I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
5
votes
2answers
103 views

Is reusing keys for CBC and CBC-MAC secure when using encrypt-then-MAC?

I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal ...
5
votes
1answer
397 views

Brute Force on 3DES with Reduced Keyspace and Unknown IV

I'm trying to brute force a 3DES problem given a reduced keyspace (ie I know the first half of the key) but with an unknown IV. The code decrypts to plaintext. My first thought was that I could set ...
5
votes
1answer
99 views

Generating an IV for AES-CBC

I am faced with the task of generating a secure 256-bit IV for AES-CBC. I possess the following resources: A 32-bit microprocessor A 32-bit PRNG (can read/reseed) A 64-bit clock counter (can read) ...
5
votes
1answer
133 views

Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
5
votes
2answers
2k views

Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
4
votes
3answers
918 views

Is there any area where AES-CBC cannot be used ? If so, why?

I would like to know the domains or specific applications where using AES-CBC is not advised due to any drawbacks like sequential encryption of AES-CBC ?
4
votes
1answer
605 views

Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”? [closed]

I recently was "directed" to FlipsCloud, a company selling security solutions (as far as I can tell). In particular I've investigated their page and found a page on their "encryption features". This ...
4
votes
3answers
6k views

Which one of the Block Cipher modes is the best?

I have two questions regarding the Block Cipher Modes: Which one of the modes is considered the best? I know CBC has a problem of IV since the next block of the plain text is XORed with the result ...
4
votes
2answers
302 views

Implementing CBC Encryption Using Decryption

I've implemented this algorithm, which, working from the end of the message backwards, creates a valid CBC ciphertext from any plaintext, using the block cipher's decryption operation instead of the ...
4
votes
2answers
5k views

How exactly does AES-NI work?

I am looking in to AES-NI which is now supported by many new CPU's and I have read a few papers which states that AES-CBC works faster with AES-NI, but I am unable to understand how exactly AES-NI ...
4
votes
3answers
657 views

Does the XML Encryption flaw affect SSL/TLS?

A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated: XML Encryption Flaw Leaves Web Services Vulnerable. Does this weakness of CBC-mode which is used here also ...
4
votes
3answers
2k views

Why does CBC decryption with a wrong IV still give readable results?

While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results. My encryption was correct. I was generating a random IV block and writing ...
4
votes
1answer
2k views

What are the advantages of CBC over ECB?

From this question I understand that, for a block cipher, using CBC is better than ECB. It seems that if one only has part of the cipher text, then decryption is difficult because the decryption ...
4
votes
2answers
282 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
4
votes
1answer
1k views

Encrypting (CBC) identical files with same key and different iv, is it less secure?

I would like to learn more about cryptography. Let's say you encrypt multiple files with CBC encryption using the same key, but each file has unique (and pseudo random) iv. Does this weakens the ...
4
votes
1answer
101 views

AES storing the length within the encrypted data versus storing it outside

I need to strip off padding after decrypting AES(CBC)-encrypted data (I have control over encryption and data transmission), so have looked at adding the length of the original data to the payload ...
4
votes
1answer
779 views

Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks CBC-...
4
votes
1answer
615 views

Alternatives to HMAC + CBC?

I'm looking at using HMAC + CBC. The combination looks like this: ciphertext = AES256(text, k1) data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext Where: ...
4
votes
1answer
4k views

Why, or when, to use an Initialization Vector?

i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
4
votes
1answer
368 views

Is this method of deterministically using CBC secure?

I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately ...
4
votes
1answer
923 views

POODLE attack on TLS 1.2

The POODLE attack uses the way block ciphers in CBC mode are decrypted in combination with the packet's padding to determine some byte's value. From what I understand, even TLS 1.1 can be vulnerable (...