# IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size?

Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this:

[IV] [Ciphertext]


Normally, the IV will be 256 bits, or 32 bytes, if the block size is 256 bits.

Is there any advantage at all in using an IV larger than this, and just splitting it and encrypting it as future blocks in the file?

ie:

# python pseudocode
cipher = AESGCM256(iv[0:32])
cipher.encrypt(iv[32:64])

block = None

while ((block = read(32) is not None):
cipher.encrypt(block)


Since the IV is a known value, is there any benefit to having a longer IV and splitting it in this regard? Conversely, is there any flaw in doing it this way?

• the block size of AES-256 is 128-bits. Also GCM has specific rules for IV's larger than 128-bits – Richie Frame Nov 17 '15 at 1:51

With e.g. CBC mode the encryption of later blocks depends on the plaintext, so it may seem like encrypting a random block would help. However, the attacker is still faced with an equally difficult problem as the first block of ciphertext effectively becomes the IV: $IV' = E_k(IV_1 \oplus IV_2)$. Here there is some advantage, since predictable (but unique) $IV_1 \oplus IV_2$ would result in an unpredictable $IV'$, and CBC requires unpredictable IVs. However, it would be better to just use an encrypted counter if you do not have a good source of random IVs.