Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?

How hard is it?

  • $\begingroup$ Welcome to Cryptography Stack Exchange. I changed the title and tags a bit, as your question (and the answer) actually applies to all block ciphers when used with CBC, not only AES. $\endgroup$ – Paŭlo Ebermann Nov 5 '11 at 22:52

With CBC (Cipher block chaining) mode, before encryption, each block is XOR-ed with the ciphertext of the previous block, to randomize the input to the block cipher (and avoid encrypting the same block twice with the same key, as this would give the same output, and tell the attacker something about the plaintext). As the first block has no previous block, here the initialization vector will be used instead.

On decryption, we will apply the block cipher to each ciphertext block, and then XOR the result with the previous ciphertext block (or the initialization vector, for the first block).

As all ciphertext blocks are known, and we have the key, we can reliably decrypt everything other than the first block, even if no or a wrong initialization vector is given.

For the first block, we actually have no information at all, without the initialization vector, other than that it has the same length as any other block (16 bytes for AES): Every 16-bytes plaintext can be reached by supplying the fitting IV. Fortunately (or unfortunately, depending of your point of view), in many file formats the first some bytes are fixed (or almost fixed, or can be guessed based on the rest of the file).

So, with CBC-mode, a secret initialization vector gives almost no protection, if the key is known to the attacker.

This applies generally: Protocols rely on the key being secret, while an initialization vector can usually be public, and often is even transmitted together with the ciphertext.

In CTR mode, a secret initialization vector (there called "nonce") will actually help a bit more to keep the plaintext secret - but if the attacker can guess even one plaintext block (and has the corresponding ciphertext block), he can (given the key) calculate the corresponding counter value, and from this the nonce. Don't let the attacker have the key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.