I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic encryption. Why is GCM-SIV superior to claim CBC with fixed IV?
Why is GCM-SIV superior to CBC with fixed IV?
From a confidentiality standpoint:
- GCM-SIV changes it's internal IV (with very high probability) when the message changes at any position, thus it's vulnerability is limited to allowing detection that two messages are fully identical (and then only if it's not supplied a proper nonce).
- Contrast with CBC with fixed IV, which allows detection of the number of blocks up to which two messages are identical.
From an integrity standpoint:
- GCM-SIV detects message alteration (with very high probability).
- CBC does not.
Further: the lack of integrity assurance in CBC often enables exploitation of a decryption device to mount attacks on confidentiality, e.g. a padding oracle attack, perhaps allowing full decryption of messages.