4
$\begingroup$

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV?

I have multiple devices with poor entropy sharing the same key and I want to ensure the IV is unique. I am using AES-128 CBC.

Can I use some bits of the IV as the ID of the device? For example can I set the first 32 bits of IV to the IP address of the device and the remaining 96 bits to a random value? Is this still considered 'unpredictable'?

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ You could start with a unique value and encrypt it to obtain an unpredictable value. $\endgroup$ – CodesInChaos Mar 2 '16 at 14:40
  • 1
    $\begingroup$ @CodesInChaos : ​ In that case, it would be important to use a computationally independent key, since using the same key would reveal when the plaintext starts with a full 0-block. ​ ​ ​ ​ $\endgroup$ – user991 Mar 2 '16 at 16:16
  • 1
    $\begingroup$ @RickyDemer, encrypting a counter to generate an IV is fine with even the same key. Nothing is revealed if you treat the IV as normal after generating it. (Or nothing more than encrypting an extra block of plaintext would reveal.) $\endgroup$ – otus Mar 2 '16 at 16:30
  • 1
    $\begingroup$ @otus : ​ ​ ​ Although my reasoning was wrong, since I was thinking of something else, I believe my conclusion is nonetheless correct. ​ Encrypting a merely-unique value with the same key would not suffice, although encrypting a not-adversarially-controllable unique value would suffice. ​ ​ ​ ​ $\endgroup$ – user991 Mar 2 '16 at 16:45
  • 1
    $\begingroup$ @RickyDemer, that is true, the input must not be controllable, but that is a property also required from e.g. CFB IVs. $\endgroup$ – otus Mar 2 '16 at 16:46
2
$\begingroup$

It is the IV as a whole that needs to be unpredictable... but knowing some bits would make guessing the IV easier.

The requirement of an unpredictable IV has to do with chosen plaintext attacks. If the attacker can predict the IV, they can choose the first block of plaintext such that they can verify any guesses they have for the content of previous messages. For this to work, they must be able to end up with exactly the right input to the cipher – even a one-bit difference will generate a completely different ciphertext block and not verify the guess. (It would verify a slightly different "guess", which might sometimes be important, so getting very close to predicting could still be a problem.)

By using some bits of the IV on the predictable IP address, you make it that much easier to guess the rest. If the other 96 bits were completely random, the attacker would have a $2^{-96}$ chance of correctly guessing it, which is uselessly small. If it was less random then the attacker could have a chance.

By reducing the random part of the IV you also make IV collisions more likely (between IVs of the same device). The situations where this would be helpful are few. For example if you have a good CSPRNG but equal/close seeds on the different devices. If that was the case you would be better off seeding the CSPRNG with the IP/MAC in addition. Or using deterministic derivation of IVs as CodesInChaos suggested.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I think you mean ChosenPlaintextAttacks... $\endgroup$ – Cryptographeur Mar 3 '16 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.