0
$\begingroup$

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText to offer both authentication and prevent identical cipherTexts.

iv.mac1.cipherText(plainText)

The keys are derived using HMAC for simplicty (alternatively could be HKDF)

masterkey = [32 random bytes];
encryptionKey = hmac_sha256(masterkey,'encryption_key');
mac = hmac_sha256(masterkey,'mac_key');
ivInput = [2 random bytes];
iv = hmac_sha256(masterkey,ivInput);

Would this already deliver enough 'randomness' for almost any messaging system, since with 2 bytes the chance of arriving at an identical cipherText with an identical message would already be around 0.002% (1/(256*256)*100)?

(256 possibilities per byte, 2 bytes used for IV)

$\endgroup$
1

1 Answer 1

2
$\begingroup$

Would this already deliver enough 'randomness' for almost any messaging system, since with 2 bytes the chance of arriving at an identical cipherText with an identical message would already be around 0.002% (1/(256*256)*100)?

Actually, with 100 messages, there are $\binom{100}{2} = 4950$ pairs of messages, and so the expected number of pairs of messages with identical IVs (which is not precisely the same as the probability that there will be two messages with the same IV) is circa 0.0755.

And, for any such pair of messages with identical IVs, it would leak (at the very least) whether or not the first 16 bytes are identical.

I am of the opinion that a 7% probability of leaking this amount of information is too high, even if you are limited to encrypting only 100 messages (and many systems will end up encrypting far more)

$\endgroup$
4
  • $\begingroup$ Is it more of a birthday paradox? Would 3 bytes be enough? I don't fully understand the given math behind the 4950 pairs of messages. $\endgroup$ Commented Jul 5, 2022 at 14:14
  • $\begingroup$ @swordsecurity: it is the birthday paradox; I believe 16 would be sufficient; is there a specific reason to use fewer? $\endgroup$
    – poncho
    Commented Jul 5, 2022 at 14:15
  • $\begingroup$ Well, if it would be viable, then perhaps more systems could use short IV's rather than using static IV's (and having to use unique keys each time) in order to save storage. $\endgroup$ Commented Jul 5, 2022 at 14:19
  • $\begingroup$ Ah I think I see it now. The derivation (using the master key) doesn't matter for the randomness: 2 bytes input IV still remains only 2 bytes of possibilities, so shorter IV's are not really viable. Thank you!! $\endgroup$ Commented Jul 5, 2022 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.