Random data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.

learn more… | top users | synonyms (1)

3
votes
1answer
106 views

Possible CPA or CCA attack when using AES-CBC mode under the following situation?

Both client and server know a shared key in advance. Both sides us EVP_BytesToKey() derive a pair of same key and same IV. Then, client and server start transferring data encrypted by AES-CBC mode ...
4
votes
1answer
119 views

What's the consequence of having a short IV? Is one mode better in that case?

I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along ...
4
votes
3answers
176 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
1
vote
1answer
89 views

Adding an IV to an AES implementation

I have an embedded project that requires AES, I seem to have found an AES implementation that fits the bill here: http://www.literatecode.com/aes256, but it does not include an IV. Are there any ...
3
votes
2answers
343 views

How do we compute IV+1 in CTR mode?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
0
votes
0answers
35 views

Does bad IV generation weaken CBC? [duplicate]

Let's say that I generate an IV like so: dd if=/dev/urandom of=iv.bin bs=16 count=1 Let's also say that /dev/urandom has been ...
1
vote
1answer
212 views

CBC-MAC length extension attack with IV simulation

I'm doing Matasano's challenges and struggling with second part of 49th problem where I'm asked to do the length extension attack with CBC-MAC without IV manipulation. There is a hint that I can ...
1
vote
2answers
72 views

Key cracking: Prefer many small texts over one large text?

If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to ...
1
vote
1answer
241 views

Value of “counter” when decrypting AES in CTR mode?

If – when using AES in CTR mode – you decide to use the setup where you combine the IV and the block count value into a single value, as suggested here, the first 12 bytes are your IV and the last 4 ...
2
votes
3answers
490 views

Problems with using AES Key as IV in CBC-Mode

I'm a pentester and currently analysing a web application which are using some strange encryption scheme. The point is: They encrypt using AES-128, generate a (not cryptographic secure) key and use ...
3
votes
3answers
599 views

Difference between a nonce and IV

I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil ...
3
votes
1answer
190 views

Why must IV be sent with each packet?

I was reading about Encrypt-then-MAC and everywhere I go it seems people include the IV with the ciphertext generated for each message then MAC that and send all the information concatenated. Why do ...
1
vote
1answer
78 views

Is it possible to deduce the IV from CBC ciphered data, without knowing the key?

The question came up here, which left me thinking: Is it possible to deduce the IV from CBC ciphered data, without knowing the key? And if not, why is it considered a bad idea to create an IV by, for ...
0
votes
1answer
105 views

IV = Filename XOR CipherKey?

i want to encrypt transparently using Rijndael. So this is, what I thought of and I would like to have an opinion from "Experts" whether this will harm encryption strenght. I am using chunks of 1MB ...
1
vote
1answer
774 views

CryptoJS.AES result always has same first few bytes?

When using this very minimal CryptoJS AES example: ...
2
votes
0answers
55 views

How to generate initial vectors during DPA attack on stream cipher in real life?

I was trying to understand the procedure of the DPA attack on Stream cipher (like Mickey-128). I learned that, the attacker need to build hypothetical power consumption matrix with different initial ...
0
votes
2answers
171 views

IV/Nonce in CTR&GCM mode of operation

We know reusing IV can compromise our secrecy. I have some questions aiming to clarify the use of an IV/Nonce in CTR/GCM: Is it OK to use the same key for encrypting plain-texts in authenticated ...
1
vote
1answer
259 views

Encrypting firmware with AES and no IV [closed]

I have an embedded device with a AES CBC engine on it that is used to ensure the integrity of the firmware. I know that CBC mode requires unique IVs to be any good, but I'm unsure if it makes a large ...
1
vote
1answer
178 views

crypto design with AES256 MODE OFB

I have the following APP Design key store (contains 1:n user payload as 1:n key store entries) key store salt (is used to extend to key store password to 256 bits, stored in clear text) key store ...
1
vote
2answers
223 views

AES-CBC and IV — Encrypting multiple blocks of a file with the same IV?

I have large files which are broken into blocks of 512 KB and uploaded to a server. In my DB I store the IV, and the user knows the security key themselves. When downloading, I use the same IV and ...
3
votes
2answers
620 views

Keeping IV secret for AES CFB mode

I'm developing a security/encryption software and I'm using AES CFB (block size: 16 and key size: 32 bytes). I want to know, if I also keep IV (32 bytes) secret like the key itself (32 bytes), would ...
4
votes
1answer
88 views

Are IVs and salts the same and usable for each other uses?

I'm new in the crypto world and I've just discovered PBKDF (I used to use typed passeword as symmetric key). When using some crypto mode, you're required to ...
-4
votes
3answers
367 views

IV's from Crypto++ AutoSeededRNG always ends the same: Problem with the PRNG? [closed]

I am using a AutoSeededRNG from Crypto++ to generate IVs for use in CBC encryption. I am encoding the IVs using Base64 for future use (decryption). I notice that ...
3
votes
3answers
697 views

How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
1
vote
2answers
111 views

Encoding multiple fields with same AES key and vector?

I'd like some advice on cryptography best practices. I need to store on my web app the users' credentials (login & password) for 3rd-party sites. I'm using AES-256 with random key and ...
2
votes
1answer
560 views

How are IVs used in association with RSA Encryption?

How are IVs used in association with RSA Encryption? Can someone explain why we use them in this RSA context?
3
votes
1answer
254 views

How does the IV or initial counter increase internally for each block in AES CTR mode?

I am working on Intel AES-NI library and since the AES function is coded using low-level assembly instructions. I could not see how the IV or initial counter increases in CTR mode. In general, how ...
2
votes
1answer
686 views

How good is using AES CTR mode with initial counter as 0?

Is it advisable to use AES CTR mode with the counter initialized to 0? How good is it in security terms?
5
votes
1answer
274 views

Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
3
votes
2answers
147 views

Random session key + predictable IV

I'm using Blowfish in a toy Diffie-Hellman communications scheme. Random session keys are generated for each connection. In this case I can simply feed a null array to the IV right? The same ...
1
vote
0answers
43 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
3
votes
4answers
2k views

Initialization vector in symmetric-key encryption

Can we use symmetric-key algorithms without an initialization vector? I am making an app where both the sender and receiver share a key and there is no way to create an initialization vector for each ...
2
votes
3answers
195 views

How to renew keys for a statically-encrypted database

Preamble Before I ask this question, please accept that I fully understand that 'rolling your own' is never a good idea, and that I am a relative n00b. The only reason I am doing this the way I am is ...
1
vote
2answers
418 views

Using IV buffer after altered inside a Rijndael CBC Encryption/Decryption process as IV for next message?

When sending a block to be decrypted or encrypted, with RijndaelCBC, we input the data to decrypt/encrypt and an IV for syncing and to prevent identical outputs for identical inputs. This question is ...
3
votes
1answer
333 views

Generating an IV for ESP 3DES-CBC

I have an application written in C, running in Linux. It uses IPsec (ESP) (manually putting the IPSec packet together) to send certain packets. The algorithm used ...
1
vote
0answers
433 views

Keepass Twofish plugin security

Keepass is a well known open-source password manager program, with plugin support. One of the offered plugin is a twofish encryption mode of operation in lieu of the build-in AES algorithm ...
4
votes
1answer
189 views

Swapping Key and IV in AES? Safe?

I have an application where I want to be able to send an encrypted file, and then mete out "keys" that allow the receipient to decrypt the file from a certain point to the end of the file. Actually, ...
3
votes
1answer
226 views

iOS Data Protection: What is the Input of the LFSR?

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine, which uses the key to encrypt the ...
3
votes
2answers
489 views

Encrypted counter as IV in CBC mode encryption using same key

I'm currently working with a secure transport protocol that defines the IV to be a counter (incremental nonce) to be encrypted with the same key. This is a followup to a protocol that did not provide ...
5
votes
1answer
345 views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...
3
votes
0answers
55 views

CBC with random prefix but no IV - secure? [duplicate]

I'm looking at a datagram-based protocol that encrypts a payload. The payload is encrypted with AES or blowfish in CBC mode, and the result is then authenticated with a HMAC. To save space, the ...
1
vote
0answers
171 views

IV and Headers inside cipher text

I am a bit confused about the use of IV, and key hash. Is the key hash and IV stored inside the headers of the cipher text? Isn't it a security risk to store this header information? By key hash I ...
2
votes
1answer
209 views

Why restrict nonce/IV and counter to specific sizes?

When setting up a nonce/IV and counter (e.g. for AES-GCM-128), why are the nonce/IV and counter restricted to specific sections (e.g. random nonce/IV in first 8 bytes and counter in last 8 bytes)? ...
3
votes
2answers
259 views

How to calculate leaked information from a check digit

Given a check digit calculated using mod 11, of an encrypted numeric sequence of 8 digits, how much information can be known about the plaintext? More specifically, a single 3DES encrypted CBC block ...
15
votes
2answers
1k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at this question. My question is not the same. I've unique keys encrypting (in CBC mode, AES-256) each plaintext, i.e. I do not use a key to encrypt more than one plaintext. Is it ...
2
votes
2answers
252 views

IV Security Clarification

After doing lots of reading on SO and other websites relating to AES cryptography, I am trying to understand the security issues surrounding IV's. There seems to be a lot of confusion and ...
2
votes
2answers
161 views

No IV for one off symmetric file encryption

My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure. I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV ...
2
votes
2answers
319 views

Generating IV in TLS 1.2

I'm writing a TLS 1.2 implementation (in C#) using a custom protocol. My question is how to generate the IV attached to each message, I don't want to use RandonNumberGenerator because I've heard it ...
2
votes
1answer
185 views

Can prepending “junk” be equivalent to an IV when encrypting using CBC?

We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
5
votes
1answer
211 views

Is there an existing AEAD scheme with minimal IV requirements?

Is there an existing AEAD scheme such that, for inputs with the same AD and IV ciphertexts are allowed to leak whether or not their plaintexts are equal, if the scheme can process the plaintext in a ...