Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?

How hard is it?

  • $\begingroup$ Welcome to Cryptography Stack Exchange. I changed the title and tags a bit, as your question (and the answer) actually applies to all block ciphers when used with CBC, not only AES. $\endgroup$ Nov 5, 2011 at 22:52
  • $\begingroup$ Yes, starting from the last block back to the first. I'm going to write a demonstration below. $\endgroup$
    – Maf
    Apr 16, 2020 at 13:37
  • $\begingroup$ Dang, I looked over and over for a dupe. $\endgroup$
    – Maarten Bodewes
    Apr 15, 2022 at 20:47

4 Answers 4


With CBC (Cipher block chaining) mode, before encryption, each block is XOR-ed with the ciphertext of the previous block, to randomize the input to the block cipher (and avoid encrypting the same block twice with the same key, as this would give the same output, and tell the attacker something about the plaintext). As the first block has no previous block, here the initialization vector will be used instead.

On decryption, we will apply the block cipher to each ciphertext block, and then XOR the result with the previous ciphertext block (or the initialization vector, for the first block).

As all ciphertext blocks are known, and we have the key, we can reliably decrypt everything other than the first block, even if no or a wrong initialization vector is given.

For the first block, we actually have no information at all, without the initialization vector, other than that it has the same length as any other block (16 bytes for AES): Every 16-bytes plaintext can be reached by supplying the fitting IV. Fortunately (or unfortunately, depending of your point of view), in many file formats the first some bytes are fixed (or almost fixed, or can be guessed based on the rest of the file).

So, with CBC-mode, a secret initialization vector gives almost no protection, if the key is known to the attacker.

This applies generally: Protocols rely on the key being secret, while an initialization vector can usually be public, and often is even transmitted together with the ciphertext.

In CTR mode, a secret initialization vector (there called "nonce") will actually help a bit more to keep the plaintext secret - but if the attacker can guess even one plaintext block (and has the corresponding ciphertext block), he can (given the key) calculate the corresponding counter value, and from this the nonce. Don't let the attacker have the key.


Yes, you can, but you might not be able to decrypt the first block if you don't know the IV.

CBC encryption encrypts block-by-block, using the previous ciphertext XOR'ed with the current plaintext block as input of the block cipher, the result of which form the ciphertext blocks.

enter image description here

So you can decrypt each block by performing the block decrypt, and then XOR-ing with the previous ciphertext block, giving you a plaintext block.

enter image description here

This can be performed for each block, with the possible exception of the first block, for which you need the IV. If you don't know you can try and guess the IV. If the result of the decryption already looks like plaintext then the IV is probably all zeros.

If you cannot find out any information about the IV then you're out of luck for the first block of plaintext. The reason for this is that the IV then acts as the key stream of a one-time-pad. And a one-time-pad is fully secure in a information-theoretical sense.

AES always has a block size of 16 bytes, which means that the first 16 bytes of the encrypted message might remain secret.

Note that it is quite common to prefix the IV to the ciphertext. If you cannot read the initial 16 bytes (assuming AES) then it might well be that the first 16 bytes are the IV and that the plaintext starts at the second block.

Images by WhiteTimberwolf (SVG version)


Paŭlo Ebermann’s answer is spot-on. For a working example using openssl, consider the ciphertext below, which was encrypted using AES-128-CBC. The encryption key used was 1AFFB43263983EE5C3DC75BC5FF76D06, but the iv is not known:


The output above is formatted with 16 bytes in each row, so that each row of 16 bytes represents one block of ciphertext. Without the iv, we can not decrypt the first block, but we can decrypt all of the remaining blocks. To do so, we simply remove the first block of ciphertext, and use this block as the iv:

echo -n '8219a48d3a9b6e0ed263d2d54f7953c8025ca84b88574ce567af96482598a4960e76394cbe347fd5ddbca644272979cb6ee3287d3ccc02520bfdd53c93c4de5bb85488940d97f8295139c445defefb73' | xxd -p -r | openssl aes-128-cbc -d -K 1AFFB43263983EE5C3DC75BC5FF76D06 -iv 7ea9fac5d627a27f7c3ec776cc059bd0 

The resulting plaintext is:

even years ago our fathers brought forth on this continent, a new nation…

Can you guess what the first block of plaintext was?


Despite the IV is usually public in real world, let me assume the only IV you don't know is the first because the IV used for each other block is the corresponding previous block:

C2 = Encryption (K, C1⊕P2)P2 = C1 ⊕ Decryption (K, C2)

The expression above can be used to compute all the subsequent blocks; the first is computed as follows:

C1 = Encryption (K, IV⊕P1)P1 = IV ⊕ Decryption (K, C1)

For the first block I can get the value of IV⊕P1 from Decryption (K, C1) as I know K and C1.

  • $\begingroup$ Don't forget to remember the Kerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. $\endgroup$
    – Maf
    Apr 16, 2020 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.