# Guessing the IV for CBC

If I have the key, the ciphertext under AES-CBC and the plaintext, then how can I guess the initialisation vector?

CBC mode decryption for the first block is defined as:

$$P_0 = IV \oplus D_k( C_0 )$$

where $P_0$ is the first plaintext block, $C_0$ is the first ciphertext block, and $D_k$ is the decryption by the block cipher using the key $k$.

This can be rearranged as:

$$IV = P_0 \oplus D_k( C_0 )$$

which allows you to reconstruct the IV, if you know the key, the plaintext and the ciphertext.

• That said, if you don't know the original plaintext, you can at least recover all but the original block of plaintext without having the IV. – Stephen Touset Dec 20 '15 at 1:35
• @StephenTouset In addition, you can never retrieve the first block of plaintext if the IV was truly random and unknown, since the first block would be encrypted with a one-time-pad (or something sufficiently similar in case a well seeded PRNG was used). – Maarten Bodewes Dec 22 '15 at 13:46