4
$\begingroup$

I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be changed (probably forever).

Is it secure if the hash value of the key is used as the IV?

Update: The key is computer generated. The user of the program have no access to the key since it's obtained by the program via secure Web API. The user can only edit a portion of data stored in the file via the program.

Improve this question
$\endgroup$
1
  • $\begingroup$ Welcome to crypto; your question was migrated here by the SO mods as it is a better fit here. Feel free to register here to receive notification of your responses :) $\endgroup$
    – user46
    May 23, 2012 at 9:51

1 Answer 1

Reset to default
5
$\begingroup$

No, it is not secure.

From NIST 800-38:

The OFB mode requires a unique IV for every message that is ever encrypted
under the given key. If, contrary to this requirement, the same IV is used
for the encryption of more than one message, then the confidentiality of
those messages may be compromised

Given your description, you are apparently safe, because at any one time you have one file only.

However:

  • A malicious user may store away an earlier version of the file and do a comparison after a change and learn which bits flipped in the first block where that happened.
  • In the future, you may add a second file and not remember the rule above.

A unique (not necessarily truly random) IV per message is still recommended.

Improve this answer
$\endgroup$
8
  • $\begingroup$ A solution to this is to store a random IV in the file header, xor'ed with the hash of the password. When you decrypt, compute the password hash and xor against the stored value, then use the result as the IV. This gives you a safe way to store the IV, and a unique IV per file. $\endgroup$
    – Polynomial
    May 23, 2012 at 9:59
  • $\begingroup$ @Polynomial Why xor the IV with the password hash? Sounds dubious to me. $\endgroup$
    – CodesInChaos
    May 23, 2012 at 10:34
  • $\begingroup$ @CodeInChaos It's not intended to be some hair-brained "increase the entropies!" scheme, if that's what you're concerned about. The idea is to xor the IV with the hash when storing it in the file, so it can't be known by an attacker without knowing the password. $\endgroup$
    – Polynomial
    May 23, 2012 at 10:39
  • 2
    $\begingroup$ @Polynomial: For OFB (and in general), the initialization vector doesn't have to be secret (as it will be passed through the cipher before being used). $\endgroup$
    – Paŭlo Ebermann
    May 23, 2012 at 17:58
  • $\begingroup$ What about other modes like CBC, ECB and CFB? Do they share the same problem? $\endgroup$
    – Lacek
    May 24, 2012 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.