I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which makes sense. My question though is that how can someone decrypt the private key but knowning only the passphrase? I have checked the file's metadata and couldn't see any references about the IV. Could someone explain this please?


1 Answer 1


Actually, PuTTY derives both the AES key and the IV (and the HMAC key) from the passphrase; because the decryptor also knows the passphrase, he can recover the IV along with the AES/HMAC keys.

This isn't quite as bad as it sounds; the transform (Argon2) from passphrase to key/IV also includes a salt (a nonce which is given in the clear); as long as the salt is different each time, then you won't use the same key/IV to encrypt two different messages, even if you encrypt the messages with the same passphrase.

Now, if we look beyond PuTTY, what most protocols that use CBC mode (it's going out of style) do is have the encryptor select an IV randomly, and include that in with the ciphertext (it doesn't matter if the adversary knows it); most commonly immediately in front in the CBC ciphertext. If you're studying CBC mode use in general, you should keep this in mind.

  • $\begingroup$ Thank you. Would you be able to share any references or the math behind it? I was reading about AES in general and it says users don’t need to worry about the IV as it can be extracted from encrypted data, but I am keen to know how mathematically (without sharing the IV) $\endgroup$
    – 0xab3d
    Apr 17 at 20:10
  • $\begingroup$ @0xab3d: I don't know what you read about someone being able to extract the IV from the ciphertext (since the ciphertext is only slightly longer than the plaintext; less than the IV length, then there's not enough information there). On the other hand, if the receiver happens to know what the first block of the plaintext is apriori, then it is easy; he'd just decrypt the first ciphertext block, xor that with the known first plaintext block, and that's the IV $\endgroup$
    – poncho
    Apr 17 at 21:20
  • $\begingroup$ Thanks. I just need to understand the flow of decryption here. For example, during the key generation process I randomized the IV value by moving the mouse randomly, right? When I share the ppk file with another user, they only need to type in the key. How was the IV derived? Is it the fist 16 bytes of the private data or something like this encrypted and this can be decrypted by AES? I hope this makes sense. $\endgroup$
    – 0xab3d
    Apr 17 at 21:31
  • $\begingroup$ @0xab3d: "How was the IV derived?"; the encryptor picked a random IV (ideally using a real rng rather than depending on mouse movements), and sends that IV along with the ciphertext. When the receiver get it, it extracts the IV from the ciphertext and then uses it to decrypt the ciphertext. $\endgroup$
    – poncho
    Apr 17 at 21:42
  • 1
    $\begingroup$ @0xab3d: see tartarus.org/~simon/putty-snapshots/htmldoc/AppendixC.html ; section C.4 $\endgroup$
    – poncho
    Apr 18 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.