Can CBC ciphertext be decrypted if the key is known, but the IV not?

Question

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?

How hard is it?

Answer 1

With CBC (Cipher block chaining) mode, before encryption, each block is XOR-ed with the ciphertext of the previous block, to randomize the input to the block cipher (and avoid encrypting the same block twice with the same key, as this would give the same output, and tell the attacker something about the plaintext). As the first block has no previous block, here the initialization vector will be used instead.

On decryption, we will apply the block cipher to each ciphertext block, and then XOR the result with the previous ciphertext block (or the initialization vector, for the first block).

As all ciphertext blocks are known, and we have the key, we can reliably decrypt everything other than the first block, even if no or a wrong initialization vector is given.

For the first block, we actually have no information at all, without the initialization vector, other than that it has the same length as any other block (16 bytes for AES): Every 16-bytes plaintext can be reached by supplying the fitting IV. Fortunately (or unfortunately, depending of your point of view), in many file formats the first some bytes are fixed (or almost fixed, or can be guessed based on the rest of the file).

So, with CBC-mode, a secret initialization vector gives almost no protection, if the key is known to the attacker.

This applies generally: Protocols rely on the key being secret, while an initialization vector can usually be public, and often is even transmitted together with the ciphertext.

In CTR mode, a secret initialization vector (there called "nonce") will actually help a bit more to keep the plaintext secret - but if the attacker can guess even one plaintext block (and has the corresponding ciphertext block), he can (given the key) calculate the corresponding counter value, and from this the nonce. Don't let the attacker have the key.

Answer 2

Yes, you can, but you might not be able to decrypt the first block if you don't know the IV.

CBC encryption encrypts block-by-block, using the previous ciphertext XOR'ed with the current plaintext block as input of the block cipher, the result of which form the ciphertext blocks.

So you can decrypt each block by performing the block decrypt, and then XOR-ing with the previous ciphertext block, giving you a plaintext block.

This can be performed for each block, with the possible exception of the first block, for which you need the IV. If you don't know you can try and guess the IV. If the result of the decryption already looks like plaintext then the IV is probably all zeros.

If you cannot find out any information about the IV then you're out of luck for the first block of plaintext. The reason for this is that the IV then acts as the key stream of a one-time-pad. And a one-time-pad is fully secure in a information-theoretical sense.

AES always has a block size of 16 bytes, which means that the first 16 bytes of the encrypted message might remain secret.

---

Note that it is quite common to prefix the IV to the ciphertext. If you cannot read the initial 16 bytes (assuming AES) then it might well be that the first 16 bytes are the IV and that the plaintext starts at the second block.

---

Images by WhiteTimberwolf (SVG version)

Answer 3

Paŭlo Ebermann’s answer is spot-on. For a working example using openssl, consider the ciphertext below, which was encrypted using AES-128-CBC. The encryption key used was 1AFFB43263983EE5C3DC75BC5FF76D06, but the iv is not known:

7ea9fac5d627a27f7c3ec776cc059bd0
8219a48d3a9b6e0ed263d2d54f7953c8
025ca84b88574ce567af96482598a496
0e76394cbe347fd5ddbca644272979cb
6ee3287d3ccc02520bfdd53c93c4de5b
b85488940d97f8295139c445defefb73

The output above is formatted with 16 bytes in each row, so that each row of 16 bytes represents one block of ciphertext. Without the iv, we can not decrypt the first block, but we can decrypt all of the remaining blocks. To do so, we simply remove the first block of ciphertext, and use this block as the iv:

echo -n '8219a48d3a9b6e0ed263d2d54f7953c8025ca84b88574ce567af96482598a4960e76394cbe347fd5ddbca644272979cb6ee3287d3ccc02520bfdd53c93c4de5bb85488940d97f8295139c445defefb73' | xxd -p -r | openssl aes-128-cbc -d -K 1AFFB43263983EE5C3DC75BC5FF76D06 -iv 7ea9fac5d627a27f7c3ec776cc059bd0 

The resulting plaintext is:

even years ago our fathers brought forth on this continent, a new nation…

Can you guess what the first block of plaintext was?

Answer 4

Despite the IV is usually public in real world, let me assume the only IV you don't know is the first because the IV used for each other block is the corresponding previous block:

C2 = Encryption (K, C1⊕P2) ⇒ P2 = C1 ⊕ Decryption (K, C2)

The expression above can be used to compute all the subsequent blocks; the first is computed as follows:

C1 = Encryption (K, IV⊕P1) ⇒ P1 = IV ⊕ Decryption (K, C1)

For the first block I can get the value of IV⊕P1 from Decryption (K, C1) as I know K and C1.