0
$\begingroup$

This question already has an answer here:

I am using AES/CBC to encrypt my http cookie. I never encrypt the same cookie value twice so my understanding is I don't need to use a random initial vector - using a fixed initial vector is fine for this case. A random initial vector is needed if we may encrypt the same message more than one. Is my understanding correct for my case?

$\endgroup$

marked as duplicate by figlesquidge, e-sushi, Ilmari Karonen, otus, DrLecter Jun 5 '14 at 8:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from stackoverflow.com May 28 '14 at 14:24

This question came from our site for professional and enthusiast programmers.

  • $\begingroup$ Using a fixed IV will also leak the information about the length of any shared prefixes. Also note that CBC won't stop someone from tampering with the cookie so that it decrypts to something that you don't expect, and if an attacker can guess at some of the cookie's contents, he will have a degree of control over what this is. $\endgroup$ – Seth May 28 '14 at 23:18
  • $\begingroup$ @Seth that's basically the answer. Actually, you could compare prefixes and extract information from that if you have information about what is encrypted. Could you write one up? $\endgroup$ – Maarten Bodewes Jun 2 '14 at 23:00
  • 1
    $\begingroup$ To questions like this, I always have to ask: why? Why try to be clever? Why play with fire when it's so patently unnecessary? To save 16 bytes per request? Surely there are dozens of vastly more important things you can be spending your development energies on. Use a (cryptographically) random IV every request, slap an HMAC authentication tag on it, and move on to problems actually worth solving. $\endgroup$ – Stephen Touset Jun 4 '14 at 17:16