3
$\begingroup$

It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key.

Question: is it safe to generate IV using PBKDF2 function, which takes password and randomly generated salt as input (Scheme 2)? Or do I have to use only completely random IV which has no relationship to password whatsoever (Scheme 1)? In other words, is Scheme 2 less secure, equally secure or more secure than Scheme 1?

NOTE: To generate entropy based on password/salt I use a hybrid PBKDF2/HKDF approach described here, where PBKDF2 generates PRK which has the same length as used hash function (SHA-2) and then expands PRK to obtain sufficient entropy to populate KEY (Scheme 1) or IV + KEY (Scheme 2).

Example of Encryption Scheme 1 - traditional approach:

  1. Input data: Password and Message (e.g. plaintext to encrypt).
  2. Generate completely random SALT (using system entropy provider).
  3. Generate completely random IV (using system entropy provider).
  4. Use Password and SALT as input for PBKDF2/HKDF function, which generates and expands entropy based on input data.
  5. Use obtained entropy to set cipher KEY, use IV that was generated in step 3.
  6. Encrypt Message, send SALT + IV + cipher text to the receiver.

Example of Encryption Scheme 2 - generating IV with PBKDF2:

  1. Input data: Password and Message (e.g. plaintext to encrypt)
  2. Generate completely random SALT (using system entropy provider).
  3. Use Password and SALT as input for PBKDF2/HKDF function, which generates and expands entropy based on input data.
  4. Use obtained entropy to set cipher IV and KEY.
  5. Encrypt Message, send SALT + cipher text to the receiver.

For decrypting, we use received SALT (and possibly, IV - if Scheme 2 is used), setup cipher according to the used scheme and decrypt message.

So, is Scheme 2 less secure, equally secure or more secure than Scheme 1? In my opinion, it should not be less secure, since for every message SALT, IV and KEY are going to be completely different. Besides, IV is unpredictable, since to generate it, we use SALT - which is unpredictable, since it is considered to be completely random. It is probably more secure, since in Scheme 1, SALT and IV are known to an attacker, and in Scheme 2 an attacker knows only SALT. Even if it is said that IV does not have to be secret, is it not better to try to reveal to an attacker as little information as possible?

Can Scheme 2 help an attacker to determine password more easily than in Scheme 1?

$\endgroup$

1 Answer 1

3
$\begingroup$

It is secure. The IV only needs to be indistinguishable from random to an attacker, and it is as long as the salt is random.


There is one remark: if you extract more key + iv bytes than the hash function in PBKDF2 returns then the PBKDF2 function is executed twice. An attacker however only has to find the key, not the IV, so an attacker doesn't have to do this, halving the security provided by the number of iterations.

You could use a KBKDF (Key Based Key Derivation Function) rather than direct extraction to get the key and IV. So you would have:

S = PBKDF2(salt, password, iterations)
K = KBKDF(S, 'enc')
IV = KBKDF(S, 'iv')

A good KBKDF is HKDF-expand.

$\endgroup$
4
  • 1
    $\begingroup$ Thank you very much! I actually use a hybrid PBKDF2/HKDF approach described here, where PBKDF2 function generates PRK of the same length as used hash function, and then expand it using HKDF. $\endgroup$
    – Acetylator
    Jun 25, 2015 at 22:59
  • $\begingroup$ @Acetylator what is KBKDF() for ruby? Which library I have to use for using this function? $\endgroup$
    – Manwal
    May 10, 2018 at 12:35
  • $\begingroup$ @Manwal KBKDF is a family name for functions that derive keys from other keys. If you search for "HKDF Ruby" they you should get some results. $\endgroup$
    – Maarten Bodewes
    May 10, 2018 at 13:02
  • $\begingroup$ @MaartenBodewes I found github.com/jtdowney/hkdf but it's very different and doesn't have any this kind of method. I have used github.com/emerose/pbkdf2-ruby for PBKDF2(salt, password, iterations). Any suggestion? $\endgroup$
    – Manwal
    May 11, 2018 at 5:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.