# Tag Info

12

It actually leaks information. You are sending: Encrypted IV: $AES(k,IV)$ First ciphertext block of CBC: $AES(k, M_1 \oplus IV)$ Eavesdropper can observe whether the two blocks are equal, which happens iff $M_1$ is all zeroes.

3

It seems you want to make the IV secret for security purposes, in direct opposition to common knowledge and NIST recommendation that non secret keying material (such as a non-secret initialization vector) be... non secret. So that goes against some of the wisdom espoused a few years ago by Bart Preneel in this video, which says that IVs should be kept ...

1

If the IV is all zeroes, then you basically have ECB for the first block. Basically you're proposing to use this first block's encryption as the IV for the second block. You're implying that the first block will always be unique, but low entropy, which sounds like a counter or time stamp. There are attacks when the IV is predictable, and while this is a ...

1

No. ​ An adversary who knows a ciphertext and one of its plaintext blocks p can trivially find the corresponding xored-plaintext x. ​ Since block ciphers with fixed keys are bijections, if there is a previous plaintext block then x has at least as much entropy as that previous plaintext block. (In particular, x can very easily be different from your other ...

Only top voted, non community-wiki answers of a minimum length are eligible