# Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?

How hard is it?

• Welcome to Cryptography Stack Exchange. I changed the title and tags a bit, as your question (and the answer) actually applies to all block ciphers when used with CBC, not only AES. – Paŭlo Ebermann Nov 5 '11 at 22:52
• Yes, starting from the last block back to the first. I'm going to write a demonstration below. – Maf Apr 16 '20 at 13:37

With CBC (Cipher block chaining) mode, before encryption, each block is XOR-ed with the ciphertext of the previous block, to randomize the input to the block cipher (and avoid encrypting the same block twice with the same key, as this would give the same output, and tell the attacker something about the plaintext). As the first block has no previous block, here the initialization vector will be used instead.

On decryption, we will apply the block cipher to each ciphertext block, and then XOR the result with the previous ciphertext block (or the initialization vector, for the first block).

As all ciphertext blocks are known, and we have the key, we can reliably decrypt everything other than the first block, even if no or a wrong initialization vector is given.

For the first block, we actually have no information at all, without the initialization vector, other than that it has the same length as any other block (16 bytes for AES): Every 16-bytes plaintext can be reached by supplying the fitting IV. Fortunately (or unfortunately, depending of your point of view), in many file formats the first some bytes are fixed (or almost fixed, or can be guessed based on the rest of the file).

So, with CBC-mode, a secret initialization vector gives almost no protection, if the key is known to the attacker.

This applies generally: Protocols rely on the key being secret, while an initialization vector can usually be public, and often is even transmitted together with the ciphertext.

In CTR mode, a secret initialization vector (there called "nonce") will actually help a bit more to keep the plaintext secret - but if the attacker can guess even one plaintext block (and has the corresponding ciphertext block), he can (given the key) calculate the corresponding counter value, and from this the nonce. Don't let the attacker have the key.

Paŭlo Ebermann’s answer is spot-on. For a working example using openssl, consider the ciphertext below, which was encrypted using AES-128-CBC. The encryption key used was 1AFFB43263983EE5C3DC75BC5FF76D06, but the iv is not known:

7ea9fac5d627a27f7c3ec776cc059bd0
8219a48d3a9b6e0ed263d2d54f7953c8
025ca84b88574ce567af96482598a496
0e76394cbe347fd5ddbca644272979cb
6ee3287d3ccc02520bfdd53c93c4de5b
b85488940d97f8295139c445defefb73


The output above is formatted with 16 bytes in each row, so that each row of 16 bytes represents one block of ciphertext. Without the iv, we can not decrypt the first block, but we can decrypt all of the remaining blocks. To do so, we simply remove the first block of ciphertext, and use this block as the iv:

echo -n '8219a48d3a9b6e0ed263d2d54f7953c8025ca84b88574ce567af96482598a4960e76394cbe347fd5ddbca644272979cb6ee3287d3ccc02520bfdd53c93c4de5bb85488940d97f8295139c445defefb73' | xxd -p -r | openssl aes-128-cbc -d -K 1AFFB43263983EE5C3DC75BC5FF76D06 -iv 7ea9fac5d627a27f7c3ec776cc059bd0


The resulting plaintext is:

even years ago our fathers brought forth on this continent, a new nation…


Can you guess what the first block of plaintext was?

Despite the IV is usually public in real world, let me assume the only IV you don't know is the first because the IV used for each other block is the corresponding previous block:

C2 = Encryption (K, C1⊕P2)P2 = C1 ⊕ Decryption (K, C2)

The expression above can be used to compute all the subsequent blocks; the first is computed as follows:

C1 = Encryption (K, IV⊕P1)P1 = IV ⊕ Decryption (K, C1)

For the first block I can get the value of IV⊕P1 from Decryption (K, C1) as I know K and C1.

• Don't forget to remember the Kerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. – Maf Apr 16 '20 at 15:26