Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
389
questions
2
votes
3
answers
6k
views
Does the Initialization Vector in DES have to be 8 bytes long?
I was experimenting around with DES and decided to implement an IV (Initialization Vector) for it. I noticed that in DES, which is 56 bits and 8 parity bits, the IV would be 8 bytes in length. Does ...
- 31
3
votes
2
answers
4k
views
Given the key, the plain text and the cipher text can I calculate the IV used in CBC mode?
If I have the plain text, the ciphertext and the key for an AES-128 CBC operation, can I determine the IV, even if I don't know the padding (assuming the padding follows one of the more common formats)...
Pete Kofod
2
votes
1
answer
49
views
Security implications of not concatenating a 1 to the IV when using GCM
When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
- 35
0
votes
2
answers
1k
views
How to generate a 128 bit IV from a 32 bit value for AES-128 OFB
I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value 0x9a23773c (...
1
vote
1
answer
2k
views
How does reusing IV for OFB mode breaks the scheme
Consider a Plaintext P1 and Ciphertext P2, which is known to the attacker. If the attacker knows that the IV used in encrypting P1 in OFB mode is the same used to encrypt another plaintext P2, how can ...
- 11
2
votes
2
answers
2k
views
using different IV and SALT with AES-CBC but same KEY
I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC.
Now, each time I encrypt something, the ...
- 47
1
vote
1
answer
86
views
Is it safe to compute HMAC(Base64(IV) || "," || Base64(CipherText)) instead of HMAC(IV || CipherText)?
Let || be the concatenation operator.
Let CipherText = AES(Key1, IV, Message).
Let us assume AES is used in CBC mode.
I want ...
- 234
2
votes
3
answers
810
views
AES Cipher Block Chaining 128 bit message
I understand that for AES CBC you need to split the plaintext up into blocks and perform XOR'ing using the previous blocks calculations etc.
However, if your message is exactly 128 bits long, do you ...
user73367
3
votes
1
answer
856
views
Best practices for IV generation
What are the best practices for IV generation for AES and other algorithms?
Is RNG enough?
What if I cannot use RNG and need to use a variable that is related to some characteristic of the ...
- 125
0
votes
0
answers
56
views
Is it possible to encrypt a message stream with the same IV each time and for it to be secure?
I know we should ideally never reuse the IV (Depending upon the mode of encryption used), but is it possible to have a protocol which uses the same IV for the message stream and is as safe as one ...
1
vote
1
answer
306
views
Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]
I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
- 41
0
votes
1
answer
503
views
Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]
My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
- 431
0
votes
1
answer
641
views
Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?
I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set ...
- 431
3
votes
1
answer
446
views
AES-CBC streaming configuration IV usage
I am interested in the implications of using AES-CBC in a streaming configuration.
Reading the specifications of a few protocols I notice that when using AES-CBC
they include IV + ciphertext + HMAC ...
- 33
0
votes
1
answer
401
views
It is the IV shared in CBC mode?
I don't know if the IV in CBC mode is equal in both sides of the encryption and decryption operations.
I know that the IV must be unpredictable, but has it to be MACed in the encryption side to be ...
- 47
2
votes
1
answer
7k
views
AES-GCM cipher - Nonce vs IV
I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers:
https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html
As you see, IV is not ...
- 123
5
votes
3
answers
2k
views
What happens if you increment MAX counter in AES-CTR?
Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
- 151
0
votes
1
answer
367
views
Signal Protocol Header key encryption initialization vector
In Signal Protocol when you use a Double Ratchet you have 2 options:
Normal encryption = header + ciphertext
Encrypted header encryption = ...
- 344
3
votes
2
answers
235
views
Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector?
I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature:
...
- 131
0
votes
2
answers
1k
views
IVs in WEP encryption
First, I'm pretty new to the world of encryption. As I understand it, in WEP, the plaintext and CRC are XOR'd with the IV and the key (or more accurately, the key/stream, which is produced by a pseudo-...
- 23
0
votes
0
answers
425
views
Is it possible to recover the key to a decrypted file? [duplicate]
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged in CBC mode? If so how?
The file I want to recover the key from is a xml that ...
9
votes
3
answers
3k
views
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
- 582
0
votes
0
answers
49
views
What is the most secure way to encrypt certain properties in logs
I would like to encrypt certain data before logging it. Currently, I use a private key and a static IV.
Looking at generating a suitable IV I am concerned about the overhead in generating CSPRNG ...
- 101
0
votes
2
answers
123
views
Randomly initialised global counter used to encrypt the kth message with $\operatorname{IV} = \operatorname{IV} + k \hspace{5mm} mod \hspace{5mm} 2^n$ [duplicate]
The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then $\operatorname{IV} + 1$ for the second , $\operatorname{IV}+ 2$ for the 3rd etc. How ...
- 1
2
votes
1
answer
1k
views
IPsec : transmission of Initialization Vector
I am currently carrying scholar research about IPsec protocol, and I have a question regarding the IP Encapsulating Security Payload (ESP). Is the initialization vector of operation mode transmitted ...
- 63
1
vote
1
answer
381
views
IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)
I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode.
Assuming I have:
The ability to arbitrary encrypt known plaintexts
The IV
I know ...
- 111
1
vote
1
answer
849
views
AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them
I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
- 177
0
votes
1
answer
992
views
how to compute IV with AES CTR if key, plaintext and ciphertext are known?
Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
- 3
0
votes
2
answers
4k
views
Is it required to use a random IV for AES-CBC with random key per message? [duplicate]
I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough. In my case, I generated random AES key for each file to encrypt and decrypt them.
My ...
- 1
2
votes
1
answer
965
views
Alter plaintext through IV in block cipher AES in CBC mode
IV: 69bb375aa919c72aa561dd7b7ffacf66
Ciphertext: "c28ea025d10186510855d083747d6435c808d9857075abd9bfc54b094e60eaf3"
Plaintext: "SEND ENCRYPTED DATA"
I want to be able to change the resulting ...
- 63
2
votes
2
answers
7k
views
AES-256 GCM IV guidelines
If I use for example AES-256 (GCM), and my message is bigger than 256 bit (broken into smaller 256 bit blocks for encryption), should the IV change for every 256 bits of the message?
- 283
1
vote
1
answer
730
views
AES-256-CBC with random IV - storing same plaintext as same ciphertext
I am encrypting some information stored in a column of a MySQL database.
The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:...
- 13
1
vote
1
answer
208
views
Why can´t an attacker find the key if he has the plain text, the IV and the ciphertext? [duplicate]
I am reading a book about web security and they are now talking about AES CBC.
After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain ...
- 113
1
vote
2
answers
214
views
With AES-GCM, may I use multiple tags per key?
In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
- 124
2
votes
2
answers
184
views
Safely erasing encrypted data
My secret message is encrypted in a byte buffer with AES-128 in CBC mode. The first 16 bytes are the IV and the message follows contiguously. If I want to securely delete this message is it enough ...
- 193
2
votes
1
answer
441
views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
- 123
4
votes
1
answer
325
views
Crypto-shredding a file by erasing the IV instead of erasing the Key
Imagine an authenticated, encrypted file system, which uses AES-256-CTR to encrypt a 64 KB file sector, then uses HMAC-SHA256 to authenticate the 64 KB file sector (including the IV). IVs are 128-bit, ...
- 206
2
votes
1
answer
3k
views
Simulation of Chosen Plaintext Attack on CBC, Predictable IV with OpenSSL
I would like to simulate the CBC IV attack where the IV is predictable.
It's described in the answer to this question:
chosen plaintext attack on CBC, predictable iv
(Only "Yes" and "No" are valid ...
- 141
0
votes
1
answer
920
views
Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext
I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
1
vote
1
answer
235
views
Encryption using deterministic CSPRNG as secure as CSPRNG
As a beginner it seems that a scheme derived from a CSPRNG should be as secure as that CSPRNG. Is this a correct assumption? Are there restrictions or known special cases? A rough outline would be:
...
- 173
3
votes
1
answer
1k
views
Does it matter how the IV and XOR are applied for a single AES-128 block?
I want to encrypt 128 bits of data. I understand the problem with ECB, so I generate a 128-bit Initialization Vector to use for encryption and send with the encrypted data. Is there a "best" way to ...
- 203
2
votes
2
answers
2k
views
Can I find the IV of a single block of SHA256, given the plaintext and digest?
Each 512-bit block of SHA256 takes an initialization vector (IV) and message schedule and returns a digest. Knowing the message schedule and resulting digest, is it feasible to reverse the algorithm ...
- 123
1
vote
1
answer
3k
views
Decrypting an encrypted aes 256 cbc text with random IV, decrypts the string [duplicate]
This may be a basic question but bear with me.
I started encrypting a text with aes 256 cbc mode generating a random iv of 16 bytes and a key.
...
- 113
2
votes
2
answers
284
views
Encrypting current time using 3DES as a signature
I came across a peculiar system for generating "signatures" ("signatures" is within quotes because this is a bad use of 3DES) in the wild.
It works as follows: a symmetric key is generated and used ...
- 33
0
votes
1
answer
242
views
3
votes
1
answer
4k
views
Does an IV need to be used in AES CTR mode?
If I encrypt a message once using AES CTR, will I need an IV? Additionally, if I do use an IV, will I need to send it with the cipher text?
- 33
5
votes
2
answers
1k
views
Is it ok to transmit an IV as a custom HTTP header?
Considering an AES OFB encryption algorithm, suppose that I'm sending a message over HTTP (not HTTPS) and my message body contains the cyphertext. I'd like to know if transmitting a random ...
- 53
1
vote
1
answer
139
views
Doubts regarding implementing AES-128 bit algorithm in my IOT system
I want to implement AES-128 in my IoT network which consists of a Master device which runs Linux on it and slave devices which are 8-bit micro-controllers that periodically transmit data packets to ...
- 11
0
votes
1
answer
377
views
Is encrypting multiple message with same key and iv secure for this case? [duplicate]
AES256, CBC
IV is sha512 of key.
Ek[random padding | message | random padding]
How much information would be leaked from the use of the same IV & key in this way, assuming the adversary has ...
- 143
10
votes
2
answers
838
views
Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?
NIST specified SHA-2 hash functions with truncated output. Those hashes use different initialization values than SHA-256 or SHA-512. SHA-224 is based on SHA-256. SHA-384, SHA-512/224 and SHA-512/256 ...
- 92.6k