Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
No, they do not gain an advantage; part of the definition of IV is "information that is used to encrypt data which can be sent in the clear".
In fact, it is actually rather common to send the IV along with the encrypted message. TLS version 1.1, IPsec, IKEv2 are all protocols that do that.
In CBC mode (which you didn't specifically ask about, but it is the most common), the argument that it can be sent in the clear is simple. Here is CBC mode encryption:
As you can see, the IV is used as as input to encrypt the first block. In exactly the same way, we use the first ciphertext block to encrypt the second block. We send the first ciphertext block "in the clear", and hence the attacker can see it, and it does not cause a weakness. Because we use the IV in exactly the same way, sending it in the clear also does not cause a weakness. Now, there are some subtle points; the first ciphertext block is unpredictable to an attacker before he sees the message; it turns out that this is actually important, and so the IV must itself be unpredictable.
In Counter mode (the second most common case), the argument is different. Here is counter mode encryption:
In this diagram, the IV is called the 'nonce'. Now, the nonce is fed as input to the block cipher; since the block cipher is strong against known (actually, in this case, chosen) plaintext attacks, giving the attacker information about what the input to the block cipher is doesn't aid him.
