3
$\begingroup$

I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic encryption. Why is GCM-SIV superior to claim CBC with fixed IV?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
5
$\begingroup$

Why is GCM-SIV superior to CBC with fixed IV?

From a confidentiality standpoint:

  • GCM-SIV changes it's internal IV (with very high probability) when the message changes at any position, thus it's vulnerability is limited to allowing detection that two messages are fully identical (and then only if it's not supplied a proper nonce).
  • Contrast with CBC with fixed IV, which allows detection of the number of blocks up to which two messages are identical.

From an integrity standpoint:

  • GCM-SIV detects message alteration (with very high probability).
  • CBC does not.

Further: the lack of integrity assurance in CBC often enables exploitation of a decryption device to mount attacks on confidentiality, e.g. a padding oracle attack, perhaps allowing full decryption of messages.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.