Timeline for Can I use my random IV (for AES) as a salt for PBKDF2?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 22, 2014 at 15:49 | comment | added | Rob Napier | Totally agreed; I should have said "predictable by the attacker." I have a more detailed version of this question: crypto.stackexchange.com/questions/12943/… | |
| Jan 22, 2014 at 15:47 | comment | added | Thomas Pornin | The problem with the IV in TLS 1.0 (demonstrated a few years ago "in the wild", i.e. as a Youtube video of a Javascript-based attack, under the name "BEAST") was not that the attacker knew the IV, but that the attacker knew the IV before choosing the data which gets encrypted (in a chosen-plaintext attack context). In TLS 1.1 a new IV is generated for each record, and it is in the record, so the attacker can see it all right, but only after having chosen the data, which disables the attack. | |
| Jan 22, 2014 at 15:41 | comment | added | Rob Napier | TLS 1.0 computed the IV in a way that was knowable by the attacker, and this led to a "CBCATT" (openssl.org/~bodo/tls-cbc.txt). TLS 1.1 switched to an explicit IV. I don't believe that this undermines the answer, though, but would like to confirm that. | |
| Nov 20, 2012 at 17:17 | history | answered | Thomas Pornin | CC BY-SA 3.0 |