2
$\begingroup$

In ECIES and similar asymmetric schemes, is it possible to use a hash of the plaintext as the IV?

$\endgroup$
3
  • $\begingroup$ That's certainly possible, but doing so is not secure. ​ ​ $\endgroup$
    – user991
    Mar 1 '16 at 16:00
  • $\begingroup$ @RickyDemer why is this? $\endgroup$
    – Demi
    Mar 2 '16 at 6:26
  • $\begingroup$ Doing so reveals the hash of the plaintext. ​ (That lets someone test guesses at the plaintext.) ​ ​ ​ ​ $\endgroup$
    – user991
    Mar 2 '16 at 7:04
2
$\begingroup$

Taking the hash of the message as IV would not be secure, since, like Ricky Demer mentioned in comments, it would make the hash public and allow guessing. However, that is not what SIV mode does – it uses a MAC as IV.

Doing that with ECIES would be possible, but probably not a good idea:

  • Normal ECIES has single-use symmetric keys, so it requires no IVs.
  • For the same reason ECIES+SIV would not be deterministic, if that is the objective.

Unless SIV happens to be the best kind of encryption available for other reasons, there is no advantage over other forms of authenticated encryption, and probably downsides like speed (since it requires two passes over the data).

With other asymmetric systems it may be another matter. E.g. Curve25519 uses static Diffie–Hellman keys for both the receiver and sender, so using SIV would avoid total breakage on nonce reuse.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.