I am using AES/CBC to encrypt my http cookie. I never encrypt the same cookie value twice so my understanding is I don't need to use a random initial vector - using a fixed initial vector is fine for this case. A random initial vector is needed if we may encrypt the same message more than one. Is my understanding correct for my case?

  • $\begingroup$ Using a fixed IV will also leak the information about the length of any shared prefixes. Also note that CBC won't stop someone from tampering with the cookie so that it decrypts to something that you don't expect, and if an attacker can guess at some of the cookie's contents, he will have a degree of control over what this is. $\endgroup$
    – Seth
    Commented May 28, 2014 at 23:18
  • $\begingroup$ @Seth that's basically the answer. Actually, you could compare prefixes and extract information from that if you have information about what is encrypted. Could you write one up? $\endgroup$
    – Maarten Bodewes
    Commented Jun 2, 2014 at 23:00
  • 1
    $\begingroup$ To questions like this, I always have to ask: why? Why try to be clever? Why play with fire when it's so patently unnecessary? To save 16 bytes per request? Surely there are dozens of vastly more important things you can be spending your development energies on. Use a (cryptographically) random IV every request, slap an HMAC authentication tag on it, and move on to problems actually worth solving. $\endgroup$ Commented Jun 4, 2014 at 17:16