Random data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
2
votes
2answers
104 views
Generating IV in TLS 1.2
I'm writing a TLS 1.2 implementation (in C#) using a custom protocol.
My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it ...
2
votes
1answer
98 views
Can prepending “junk” be equivalent to an IV when encrypting using CBC?
We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
5
votes
1answer
135 views
Is there an existing AEAD scheme with minimal IV requirements?
Is there an existing AEAD scheme such that, for inputs with the same AD and IV
ciphertexts are allowed to leak whether or not their plaintexts are equal,
if the scheme can process the plaintext in a ...
2
votes
1answer
90 views
Does the IV need to be known by AES (CBC mode)?
I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve ...
1
vote
1answer
65 views
Is there a preferred way/standard on how to transmit an initialization vector for AES encryption
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
3
votes
1answer
129 views
What are the constraints for an IV using AES in CBC mode?
I'm designing a protocol for use into a VPN software.
The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
2
votes
2answers
178 views
Validating successful decryption in AES
I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ...
0
votes
2answers
124 views
AES encryption with shared IV
Sorry about the horrible title, didn't now what to say.
I'm trying to avoid having to send an IV with every message purely to keep packet sizes down, so I thought of a method to establish a "IV ...
3
votes
0answers
96 views
CBC with fixed IV but changing data [duplicate]
Possible Duplicate:
Using CBC with fixed IV
I am using AES in CBC mode.
For some reasons I have some issues for transmiting the IV. So I am using a fixed IV.
If the first 128bits of the ...
4
votes
1answer
78 views
Two way encryption with random IV
I'm attempting to encrypt some information into our database to be later pulled back out and displayed to the user. Searching and reading up on different methods I found a post over at stack exchanged ...
2
votes
0answers
154 views
Why not use CBC, not send IV, and assume first plaintext block is garbage? [duplicate]
Possible Duplicate:
Using CBC with fixed IV
Forgive me if this has been asked before, I looked but haven't seen any answers that suit.
Is there any danger in using CBC, encrypting a ...
4
votes
2answers
126 views
Will varying plaintext compensate for a fixed initialisation vector?
This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest.
I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
4
votes
5answers
315 views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
2
votes
1answer
328 views
Why, or when, to use an Initialization Vector?
i'm trying to figure out when an Intialization Vector (IV) should be used.
There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
1
vote
2answers
406 views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
6
votes
2answers
338 views
What's is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV. Without any doubt the key should be kept secret. But what about the nonce and the IV. What's the main difference between them and their ...
4
votes
1answer
326 views
Why is CBC with predictable IV considered insecure against CPA
I just learned that using CBC encryption with an IV which is predictable is not secure.
From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can ...
3
votes
1answer
405 views
Implementing AES encryption for firmware distribution system
I need to implement an AES encryption for firmware distribution system.
I have a bootloader that can decrypt various AES variants (ECB,CBC,CTR).
When I approached this I found few issues that aren't ...
7
votes
3answers
304 views
Is it safe to use file's hash as IV?
I'm encrypting some files using AES in CBC mode.
I'm also using file's digest (SHA-1) to check that data is decrypted correctly (so I need to store it with file).
Is it safe to use this digest as ...
6
votes
2answers
474 views
Is using a predictable IV with CFB mode safe or not?
While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine):
"For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
3
votes
4answers
277 views
Which block cipher modes of operation allow a predictable IV?
Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
1
vote
2answers
358 views
Why can't the IV be predictable when its said it doesn't need to be a secret?
I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ...
0
votes
1answer
88 views
About “nonce” in Initialization Vector(IV)
When we talk about nonce in Initialization Vector(IV), is it required to used numbers only? not any letters or special characters?
0
votes
2answers
200 views
Is the Blum Blum Shub PRNG suitable to create initialization vectors?
Is it a good idea to use a Blum Blum Shub Generator to create my initialization Vector (IV) in AES-OFB (Output Feedback Mode)?
1
vote
1answer
179 views
Generating a strong unique Initialization Vector
How can I determine if I am generating a unique and strong Initialization Vector? If my mode is generating Keystream? Is there any scientific explanation in generating a unique and strong ...
2
votes
1answer
542 views
What is the difference between these AES encryption methods
I am using AES encryption (Rijindael) with Base-64 encoding in Obj-C and VB. I am currently using the following two projects to achieve this:
Obj-C: ...
1
vote
1answer
298 views
Why must IV/key-pairs not be reused in CTR mode?
Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ...
3
votes
3answers
405 views
Why does CBC decryption with a wrong IV still give readable results?
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.
My encryption was correct. I was generating a random IV block and writing ...
2
votes
2answers
225 views
What algorithm would give the shortest ciphertext for very short plaintexts?
I have to encrypt some very short messages (approx. 5 characters) and I would like the ciphertext to be as short as possible. I am currently using AES but the initialization vector (IV) is making my ...
4
votes
1answer
185 views
Is it secure to use the hash of key as the IV in AES encryption?
I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be ...
1
vote
4answers
394 views
Is my pseudo-random initialization vector secure?
How can I know if I am generating a secure pseudorandom initialization vector?
Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
3
votes
0answers
213 views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. ...
1
vote
2answers
1k views
Initialization vector length insufficient in AES
I use AES with AES/CBC/PKCS5Padding with the following encryption and decryption code sections in Java:
...
4
votes
3answers
414 views
Encryption with “constant” initialization vector considered harmful
I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice.
For stream ciphers not doing ...
2
votes
1answer
256 views
How does Output Feedback mode use the initialization vector?
How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key?
Will I encrypt the Initialization Vector like a block of plaintext?
So ...
3
votes
3answers
560 views
Why is the IV passed in the clear when it can be easily encrypted?
The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
5
votes
2answers
633 views
How to calculate an IV when I have a shared private key?
I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
3
votes
1answer
521 views
Why not use CTR with a randomized IV?
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
5
votes
1answer
1k views
How do I correctly derive a Key and IV?
Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class).
This encryption code will be used in conjunction with existing ...
3
votes
1answer
169 views
OCB - brute force against unknown IV
I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown.
Why is that ?
Is there a ...
3
votes
1answer
720 views
Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
2
votes
1answer
148 views
Does an attacker gain an advantage if they have the initialisation vector?
Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
7
votes
1answer
1k views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is ...
6
votes
1answer
1k views
Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?
A fixed length CBC-MAC uses an all-zero block as the initialization vector.
Suppose that we used a randomized IV instead, and sent the IV along with the tag.
So if the message $m$ will be $m = b_1 || ...
4
votes
2answers
137 views
Generating non-repeating N-bit IVs, which are indistinguishable from randomness
I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
9
votes
2answers
1k views
Why use an Initialization Vector (IV)?
Why use an Initialization Vector (IV)?
How are IV's used?
What are the advantages/disadvantages of using an IV?
Why use an IV instead of a longer key in which some section of the key is pubic?
What ...
7
votes
3answers
756 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
