4
$\begingroup$

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus seems to be that our application should be FIPS 140-2 compliant if we use a FIPS certified library.

We are using the AES algorithm from a FIPS certified library — iOS commoncrypto — for the encryption of database and disk files. We generate a key dynamically based on a random salt for each encryption of a file (CBC mode, same key for different block of same file). However, we don't use any initialization vector.

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

Improve this question
$\endgroup$
6
  • 1
    $\begingroup$ If I'm reading your question right, regardless of your FIPS-compliance, if you are independently encrypting multiple blocks of a file with the same key and no (e.g., all zeroes) IV, you have a potentially severe weakness in your security architecture. $\endgroup$
    – Stephen Touset
    Commented Oct 10, 2013 at 22:44
  • $\begingroup$ thanks @StephenTouset. we are not independently encrypting multiple blocks of same file, rather we are using CCryptorCreate to create a cryptor and then use CCryptorUpdate to update the crpytor with more data (32 K bytes every update). Here is the API: developer.apple.com/library/ios/documentation/System/Conceptual/… $\endgroup$
    – windfly2006
    Commented Oct 11, 2013 at 0:36
  • 3
    $\begingroup$ Related: Why should I use an Initialization Vector (IV) when I have unique keys? $\endgroup$
    – e-sushi
    Commented Oct 11, 2013 at 2:31
  • $\begingroup$ @Stephen Touset: Why would there be any weakness? Read "We generate a key dynamically based on a random salt for each encryption" in the question's statement. Note: I pass on answering the question, which is about a regulatory requirement. $\endgroup$
    – fgrieu ♦
    Commented Oct 11, 2013 at 6:47
  • 2
    $\begingroup$ @fgrieu The statement "CBC mode, same key for different block of same file" could have been interpreted as encrypting each block independently with the same key in CBC mode, or encrypting the whole file at one time in CBC mode. If the former, very bad. If the latter, fine (at least, within the scope of CBC mode). $\endgroup$
    – Stephen Touset
    Commented Oct 12, 2013 at 1:14

2 Answers 2

Reset to default
1
$\begingroup$

Foreword

atsec IT security blog recently commented about FIPS and NIST rules with: "As technology moves on, and the pace of change increases, with no real update to the specification for a decade, FIPS 140-2 is creaking badly. To deal with this, the CMVP must issue Implementation Guidance (I.G.), which is now so complex that it is virtually impossible to understand all the nuances. We saw several presentations on the topic of several notorious implementation guidances, and even some more formal logical analysis of the I.G. themselves."

So, do not expect anybody else than CMVP to be able to guide you in this. They are supposedly the ones to decide what are the approved and allowed ways. (But you need to wait until the government shutdown ends.)

Answer

If I interpret 'without IV' very strictly, I would recommend to use ECB mode (like Mr. Stone) or maybe AES KW. AES-GCM likely does not do because of A.5.

The OP mentioned CBC mode. There is no CBC without IV, so I interpret his question to mean CBC mode, with zero IV or some other static IV.

If each file uses different key, it should be fairly ok to use static IV. However, NIST SP 800-38A (document describing basic cipher modes of operation) has two allowed ways of creating CBC mode IV, random and usage of approved cipher. Therefore, if the target is to be FIPS 140-2 compliant (which includes compliance with NIST SP 800-38A), it is likely more secure to use one of these mechanisms.

If you already generate keys randomly, I would think you could also generate random IV? Then you would be most likely compliant with the recommendation.

Alternatives

It was discussed above that it may not be recommendable to use all zeroes for CBC, but using start IV/nonce/counter of all zeroes could be OK for these modes: CTR, GCM, CCM -- assuming the key/IV pair is not reused. Maybe one of these would meet your needs?

Improve this answer
$\endgroup$
3
  • $\begingroup$ thanks. Yes, we are using all zero IVs with CBC mode. Question about your point "It was discussed above that it may not be recommendable to use all zeroes for CBC", if we are using different key for encryption of different file with CBC mode, based on some above comment (@fgrieu and @Stephen Touset), it should not be an issue, right? Or am I missing something. $\endgroup$
    – windfly2006
    Commented Oct 15, 2013 at 17:51
  • $\begingroup$ @windfly2006 From perspective of security it may be alright. The item you're missing is that the requirements for FIPS 140-2 approved implementations are given in NIST's SP 800-XXX and FIPS XXX documents. The appropriate guidance for use of AES-CBC mode is given in NIST SP 800-38A document. This document describes allowed ways of generating IV for CBC (which you must follow in case you want to claim FIPS 140-2 compliance). All zero IV would not be strictly compliant of the IV generation alternatives given in this document. Thus, read the document and consider yourself. $\endgroup$
    – user4982
    Commented Oct 15, 2013 at 18:40
  • $\begingroup$ Quote from the NIST SP 800-38A doc, App C: "There are two recommended methods for generating unpredictable IVs. The first method is to apply the forward cipher function, under the same key that is used for the encryption of the plaintext, to a nonce. The nonce must be a data block that is unique to each execution of the encryption operation." Depending on your interpretation and data, it is can be seen that static IV can be actually compatible with the definition. In case static IV is used in way that would fail compatibility with this definition, then you need to use random IV instead. $\endgroup$
    – user4982
    Commented Oct 15, 2013 at 18:57
4
$\begingroup$

No you don't need to use an IV. However, this limits you to ECB mode only — the only one which doesn't use an IV — and your CAVP (Cryptographic Algorithm Validation Program) AES certificate will indicate so.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Actually, I believe that it would be legal to use GCM will an empty (zero length) IV. Now, that means that you can't encrypt two different messages with the same key; windfly2006 already states that they abide by that restriction. $\endgroup$
    – poncho
    Commented Oct 11, 2013 at 15:03
  • $\begingroup$ FIPS 140-2 Implementation Guidance section "A.5 Key/IV Pair Uniqueness Requirements from SP 800-38D" states "the IV length shall be at least 96 bits (per SP 800-38D)" (if internally generated by the module). $\endgroup$
    – Mr. Stone
    Commented Oct 11, 2013 at 15:11
  • $\begingroup$ However, a zero length IV would not be "internally generated by the module". I'm not positive that this would pedantically meet the requirements; however FIPS does appear to allow zero length IVs (at least, that option does appear on the Algorithm Information Sheet; the "Other IV lengths supported" range does go down to 0) $\endgroup$
    – poncho
    Commented Oct 11, 2013 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.