2
$\begingroup$

What is IV predictable in the CBC mode? We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each string which is used to XOR with the plaintext, such as the first IV, c_i(the ith ciphertext)?

$\endgroup$
1

1 Answer 1

2
$\begingroup$

"Predictable IV" (with the words usually in that order) is a situation, typically undesirable for legitimate users, and desirable for attackers, such that it can be learned something about the Initialization Vector (typically of an encryption operation, sometime of a Message Authentication Code operation) before obtaining that IV legitimately (the later being typically at start of a ciphertext when in the context of CBC mode).

The notion of "predictable IV" for CBC mode most often comes in the context of attacks against CBC mode, or of the study of the security of CBC mode; typically not in use of CBC mode when that's according to plan.

The standard security argument of CBC mode under Chosen Plaintext Attack assumes that the IV is not predictable, that is an adversary can not choose the messages that it submits for encryption with some knowledge of the IV. In other words, it's assumed that somewhat the IV is unpredictable until the adversary has submitted a message to encrypt. If the IV is fully predictable, there are attacks to break indistinguishability under CPA (as pointed in a comment).

Predictable IV can occur in many ways. One example is when the IV is generated using a Pseudo Random Number Generator initialized according to system time (as used to often be the case for the rand library function of the C library). The system time is predictable to a fair degree, and that makes the IV predictable to a comparable degree.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.