2
$\begingroup$

If I have the key, the ciphertext under AES-CBC and the plaintext, then how can I guess the initialisation vector?

$\endgroup$
8
$\begingroup$

CBC mode decryption for the first block is defined as:

$$P_0 = IV \oplus D_k( C_0 )$$

where $P_0$ is the first plaintext block, $C_0$ is the first ciphertext block, and $D_k$ is the decryption by the block cipher using the key $k$.

This can be rearranged as:

$$IV = P_0 \oplus D_k( C_0 )$$

which allows you to reconstruct the IV, if you know the key, the plaintext and the ciphertext.

$\endgroup$
  • 1
    $\begingroup$ That said, if you don't know the original plaintext, you can at least recover all but the original block of plaintext without having the IV. $\endgroup$ – Stephen Touset Dec 20 '15 at 1:35
  • $\begingroup$ @StephenTouset In addition, you can never retrieve the first block of plaintext if the IV was truly random and unknown, since the first block would be encrypted with a one-time-pad (or something sufficiently similar in case a well seeded PRNG was used). $\endgroup$ – Maarten Bodewes Dec 22 '15 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.