Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Is it okay to make both the IV for AES-CFB and the salt for PBKDF2 public? Does this action of mine compromise security in any way?
I have an implementation of this cipher and had previously asked a question about this cipher on stack Overflow. One of the users who answered my question told that it is OK to make the both password salt and IV public. Not that I don't believe him but just wanted to be double sure to correct my implementation.
In cryptography an Initialisation Vector or IV is an input of fixed size required to randomize the output of a cryptographic primitive. It is not meant to be secret, so there is not problem in make it available to the attacker after the encryption. The crucial point about the IV is its uniqueness and, for some mode of operation, its unpredictability. So, if your implementation correctly generates the IV using the right random number generator there is no problem in making it public, after the encryption. Quoting poncho:
What this means that if you keep the IV secret, it doesn't really hinder any particular attack in any way. One way to see that is to assume the contrary; let us assume that, if we expose the IV to the attacker, that he can exploit some weakness. If we assume that, then the attacker can use that weakness to attack a CFB mode encrypted text without the IV; what he does is take the ciphertext (without the IV), and treat the initial ciphertext block as the IV, and the rest of the ciphertext as the "real" ciphertext; the plaintext this corresponds to is the normal plaintext with the initial block omitted.
Because of this, if exposing the IV with CFB mode lead to a weakness, CFB mode in general is weak. Now, written this way, this might not sound very comforting; however athat statement is logically equivalent to "if CFB mode is strong, then CFB mode with the IV mode exposed is strong", which is really what we want to show.
A salt is a random value added as additional input to an hash function, or to a key derivation function to protect the construction from dictionary attacks, an attacker should create a dictionary per salt. As in the IV case, the crucial property is the uniqueness. You don't want all password share the same salt (otherwise an attacker may build a dictionary to attack many password at the same time).
In both cases you should authenticate the values.
So the answer to your question is "no, it does not compromise security". You should really pay more attention to the algorithm used to generate IVs and salts (and probably salt size). And add a mode to check the integrity of the ciphertext (+ the IV) before decrypt it.
