1
$\begingroup$

I wanted to know if my understanding is correct! I have been reading up on aes encryption and modes(specifically CTR and CBC) and it took me sometime to understand the concept of IV. If the IV is generated randomly then:

In CBC mode typically IV is prepended or appended after the encryption,So the first block of the cipher text is decrypted using this first block of data recieved which is the IV and from there on the previous cipher block is the IV for the next block.

I am not sure about the practice in CTR mode but there is a counter(or nonce) that increments the IV for each block for decryption adn encryption.

If the IV is generated value then well both parties need to agree on how it is generated. And using a constant IV is not really recommended to use a fixed IV for any mode.

I also want to know, what other standard practices are in use to communicate the IV in between two parties in different AES modes?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
1
$\begingroup$

For CBC mode, the IV can be generated in any manner where it would be unpredictable to an attacker from one message to the next. In practice that means a random number generator of some kind. Since the block size is 128-bits, the probability of IV repeat before the key expiration is negligible. The CBC IV is visible to an attacker viewing your ciphertext; as you said, it is attached some how.

There does not need to be any agreement on both ends as to the method of generating it. Most implementations I know of prefix the ciphertext with the IV.

For CTR mode it is a different story. The IV is the combination of Nonce and Counter. There needs to be strict agreement on both sides how they are combined and incremented, or the other party will not be able to decrypt. Additionally if the same key is used by both parties, they need to make sure there is no Nonce reuse between the 2. This can be achieved by forcing one party to always have a specific bit of the Nonce set to 0, and the other party set that bit to 1, such as the MSB. The better option is to have 2 different keys. Since CTR mode turns the block cipher into a stream cipher, IV reuse in CTR mode is catastrophic. There is no requirement that the Nonce be unpredictable, and can be a simple message counter.

The nonce is the only part of the CTR IV that is transmitted with the message, and once again it is visible to an attacker. Most implementations I know of prefix the ciphertext with the Nonce, and the block counter for the message starts at 0, except in the case of AES-GCM.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks so much for answering,So I messed up my understanding of nonce and counter I guess So basically nonce in combination with counter is used to generate a IV.And is salt also a nonce? $\endgroup$
    – Koundinya Poluri
    Feb 19, 2015 at 6:53
  • $\begingroup$ Also can you elaborate on ctr mode making block cipher to stream cipher? $\endgroup$
    – Koundinya Poluri
    Feb 19, 2015 at 7:00
  • $\begingroup$ A salt is similar in concept to a nonce, but a nonce is REQUIRED not to repeat under the same key, whereas a salt is more like a CBC IV; it should be unpredictable and pseudorandom. Elaboration on the details of CTR is outside the scope of the answer or comments, see the wikipedia article or NIST 800-38A. $\endgroup$
    – Richie Frame
    Feb 19, 2015 at 21:13
0
$\begingroup$

I think the best reference for the exact way block modes work is the Wikipedia article on the matter: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

(They can be found in a lot of books, Wiki is just easier to reach).

Regarding the IV exchange, AES by itself doesn't do such a thing. Generally, secret exchange is done using asymmetric algorithms for encryption and signing for integrity checking. Take a look at the openssh key exchange parameter which lists some of these schemas (mostly Diffie-Hellman + MAC)

Also, there are a lot of similar questions here on StackExchange. Look for more answers there.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Thanks for replying adrain,I do understand the basic of how key exchange is done over a insecure network.But my question is specific to IV.Iv unlike key is visible to everyone to see It doesn't necessarily have to be a secret right? $\endgroup$
    – Koundinya Poluri
    Feb 18, 2015 at 10:40
  • $\begingroup$ I just wanted to know some other common practices to communicate the randomly generated IV!! $\endgroup$
    – Koundinya Poluri
    Feb 18, 2015 at 10:40
  • $\begingroup$ @AdrianH No, actually IVs don't need to be secret. In fact, the IV is usually appended in clear to the ciphertext, since it is needed for the decryption. The important requirement with IVs is that they must not repeat, under any circumstances. The nonce in the counter in CTR mode is there in order to avoid repetitions of the counter, not to make the IV secret. $\endgroup$
    – cygnusv
    Feb 18, 2015 at 11:29
  • $\begingroup$ @cygnusv You're right, bad memory on my part, I should have rechecked before posting. It doesn't have to be a secret, just random and unpredictable (and with no repetitions). Thanks for the correction, I've removed the wrong posting so nobody gets misled. $\endgroup$
    – AdrianH
    Feb 18, 2015 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.