I would like to learn more about cryptography.

Let's say you encrypt multiple files with CBC encryption using the same key, but each file has a unique (and pseudorandom) IV. Does this weaken the security of the data? Is it easier to obtain the key if you have many instances of the same data encoded with a different IV? Let's assume that the attacker knows all the files are the same or at least partially (first half) the same.

Thank you for your time.


1 Answer 1


You don't need to worry. There is no known weakness in CBC mode or AES which would mean that encrypting identical files (with different initialization vectors) makes it easier to retrieve the key, or decrypt the data.

The different initialization vector for CBC makes it sure that even the same file results in different input to the block cipher, and thus different output, so an attacker doesn't even know that these two ciphertexts are the same file (other than for the file size).

To crack AES, now the best known method is to try different keys and encrypt or decrypt one block with each, and compare the output with either captured ciphertext or known (or "guessed") plaintext (where we take the IV or previous block into account), until one matches. (For keys bigger than 128 bit, we might need to check with a second block.) If we don't know anything about the plaintext (which is quite rare, but might occur when encrypting a key), this doesn't work - and here our "twice the same file" can help:

  • decrypt the same block of both files
  • XOR each with the previous block each (or the IV in case of the first block)
  • compare.

This needs about twice the work as an ordinary known-plaintext attack, though, which is already out of any realistic ability to crack, if the key space isn't somehow reduced, i.e. if the key is generated from a password.

Note that there is a "weakness" in CBC which says that the total number of blocks to be encrypted with each key should be limited to about $2^{n/2}$, where $n$ is the block size in bits, to make the probability of repeated outputs (and thus repeated XOR-masks for the next block) neglectible. This doesn't really depend on encrypting the same or different files, though, and for 128-bit blocks, this number is quite high ($2^{68}$ bytes, around 200 exabytes, which is half of the world's total digital content (of 2009)).

  • $\begingroup$ Thank you for your answer. What if the attacker has more than 2 identical files (just different iv), lets say N. Is there a relation between N and chances that data can be decrypted. $\endgroup$
    – Ben
    Nov 8, 2011 at 16:54
  • 1
    $\begingroup$ As long as your N times the size of your file remains small compared to the $2^{68}$ bytes I mentioned in the last paragraph, the chance to get anything out of the ciphertext remains negligible. $\endgroup$ Nov 8, 2011 at 17:03
  • $\begingroup$ " the total number of blocks to be encrypted with each key should be limited to about $2^{n/2}$" -- Can you share a paper on this? $\endgroup$
    – hola
    Sep 14, 2020 at 5:08
  • 1
    $\begingroup$ @yyyy0000 I don't have a paper on this at hand, but the reason is the birthday rule – after that many random blocks (and the output is like random) you are likely to get collisions, and with collisions, attackers get ways to attack. $\endgroup$ Sep 15, 2020 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.