Does it matter how the IV and XOR are applied for a single AES-128 block?

Question

I want to encrypt 128 bits of data. I understand the problem with ECB, so I generate a 128-bit Initialization Vector to use for encryption and send with the encrypted data. Is there a "best" way to apply this IV?

The Block Cipher Modes of Operation can use the IV in a couple of ways:

• The IV is XOR'd with the payload, then this is used as the plaintext for AES, then the AES output is the ciphertext.

• The IV is the plaintext for AES, and the output is XOR'd with the payload, then this is the ciphertext.

My system is not concerned with a stream of data, only a single 128-bit block. The receiver can never be expected to have received a prior 128-bit message. So, the modes of operation (CBC, CTR, GCM, etc.) are not fully applicable.

Are each of these functionally the same for that single block? Instead of applying the IV "before" or "after" as above, what if I XOR'd the key with the IV?

Answer 1

Yes there are differences.

The first one is identical to CBC mode encryption. CBC requires an IV that is indistinguishable from random to an adversary.

The second is identical to CTR mode encryption where the IV is the initial counter value; the IV only needs to be unique - but the IV can be randomized, as a 128 bit random number is unlikely to repeat.

You never want to do anything to your key other than using it for your cipher. If you want to create multiple keys, use a Key Based Key Derivation Function such as HKDF rather than XOR.

---

Note that generally you should try and find the best mode for your operation, and only then generate your IV using the rules for that specific mode.

Authenticated encryption using an AEAD cipher such as AES in GCM mode often makes a lot of sense. GCM for instance generally uses a 96 bit IV / nonce instead of a 128 bit IV.