What is the point of the initialization vector in cryptographic modes like AES-CBC when it is sent in the public? Cant any attacker just listen and reverse the IV? and as such defeating its purpose?


I already know what has been said here. My question was: Cant any attacker just listen and reverse the IV? and as such defeating its purpose?

So, by using IV, the message 'hello' becomes (XXXX) and (yyyy) but since both have a copy of their respective IV's in the public such that (XXXX)123 and (yyyy)456 why cant I use 456 to make (yyyy) back to (XXXX) (to clarify), I am assuming that the decrypter of (yyyy)456 transformers the message in the following ways (yyyy)456 -> f(456) -> (XXXX) -> f(key) -> 'hello' so I am asking why an attacker cant just (yyyy)456 -> f(456) -> (XXXX) if 456 is already

  • $\begingroup$ Could you clarify what your notation (yyyy)456 -> f(456) -> (XXXX) means to you? I expect your imagined function f might map to some real cryptographic function(s), but none of them would just be an isolated function taking the IV as a param, with nothing else involved. Probably if you understood how f was really constructed, and which params it really took, it would be an answer to your question. $\endgroup$ – Neil Slater Sep 8 '15 at 8:54

Encryption schemes that use IVs will typically use results from previous block (or some counter combined with IV) to generate a pseudo-random bit stream to encrypt or decrypt the next block.

Without an IV, the pseudo-randomness can be based only on the key and the message (because that is the only data that the sender and receiver will both have). Which means it would be relatively easy to get repeated blocks across similar messages using the same encryption key, especially at the start of the encryption. Depending on the mode of operation, it might result in repeated blocks elsewhere too.

In addition, the IV in systems that use it is not combined in a reversible way isolated from the key. E.g. it is not simply XOR-ed into the encrypted text, or fed into the algorithm in a way that is reversible (except if you know the key it is reversible). Instead it is fed into the encryption algorithm as a modifier to the first bock of plaintext in CBC mode (when its influence changes seed generation in all consequent blocks), and/or in other modes as a modifier to the seed to the PRNG creating the bit-stream for encrypt/decrypt. To construct the full seed (and thus successfully decrypt) you need to know the key and IV at the same time - knowing just the IV would not be enough to reverse its influence. In your comment you suggest that the effect of an IV could be removed from an encrypted string, thus rendering it ineffective - because you would then have essentially the encrypted message without any influence from the IV. However, this is not possible with schemes that correctly use an IV - to perform this reversal, you would need to already know the key.

The purpose is therefore to allow re-use of same key, without any chance of exposing similarities in blocks of encrypted data. If all your messages started 'Dear Fred', then without an IV block (or some equivalent additional data to feed the PRNG given the same key), the similarity would show if you used the same key, and this would give away some information about the content of your messages.

As such, it doesn't matter that the IV is public, just that it is unique amongst all messages using the same key. The IV for encrypted messages is serving a similar purpose as a salt used for secure hashing.

| improve this answer | |

My question was: Cant any attacker just listen and reverse the IV? and as such defeating its purpose?

Yes and no.

Yes, an attacker can just listen and read the IV. In CBC mode, the IV is normally transmitted in the clear as the first block, so the attacker doesn't even have to reverse anything.

No, as the IV's purpose is not to be a secret. Being secret is the key's job. If an algorithm needed additional secrecy in the form of a secret IV, the algorithm should be considered broken.

The purpose of a random IV is to make sure that the same message, encrypted several times with the same key, always looks differently. One example of why this is important is ECB mode,

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.