# Tag Info

6

the key and plaintext is the same. The attacker knows this and the IVs used but doesn't know the plaintext. Is there anything to learn about the plaintext when multiple ciphertexts are available instead of only one? No. Giving the attacker multiple encryptions of a single plaintext using a randomly chosen IV and a fixed key with AES-CBC does not leak ...

2

If you use a random IV each time you encrypt a file, the result will be different. $$\text{AES-CBC}(IV_1, Key, M) = C_1$$ $$\text{AES-CBC}(IV_2, Key, M) = C_2$$ you do not gain any pieces of informations by having $C_1$ and $C_2$. Even knowing that they share the same key and should they share the same length, an attacker can not even know whether or not ...

7

As SEJPM notes in the comments, the IVs will repeat after $2^{32}$ frames. This is bad (unless the key is changed more often than that). In particular, if you can temporarily capture the device and make it encrypt $2^{32}$ known messages of sufficient length, you will learn the keystreams corresponding to all the $2^{32}$ possible IVs for that device. ...

3

If you have a nonrepeating (but possibly predictable) value, you can convert that into an unpredictable CBC-mode IV at fairly minimal cost. Here's how: Prepend the 128 bit nonrepeating value to the message CBC mode encrypt the (value, message), using any IV that's not correlated to the nonrepeating value (all 0's work) Use the first 16 bytes of the ...

0

Those are calculated using the "SHA-512/t IV Generation Function", as described in FIPS-180 (pdf, see 5.3.6), the Secure Hash Standard. The procedure is to first modify the normal SHA-512 IV, then calculate the hash of a string describing the truncation mode used, and use that as the IV. Those IVs are essentially just predefined hash outputs and so not any ...

Top 50 recent answers are included