1
$\begingroup$

We need to exchange some data encrypted between a device and our software where the device does not have access to a source of randomness. Both the software and the device know the key (although they cannot access it, they can only use it for encryption using AES). We are planning to use AES in CCM or CBC (depending on authentication requirements and capabilities of our crypto library) mode for encryption.

Is it wrong to send a randomly generated value from the software to the device, hash it using SHA-256, and use that for the initialization vector?

Or is it better to send the randomly generated value encrypted as well (we can generate a proper IV on the software side)? I guess it would then matter more whether we use CCM or CBC.

The communication between the device and the software can be intercepted and changed by the attacker.

$\endgroup$
  • 1
    $\begingroup$ Might I suggest you consider SIV (Synthetic Initialization Vector, tools.ietf.org/html/rfc5297) mode instead? That's a deterministic mode (doesn't assume the encryptor has any randomness) and essentially generates the IV from a plaintext (and the key). It is deterministic (if you encrypt the same message twice, you get the same ciphertext), but the encryption of related messages look random to the attacker (and any modification by the attacker (except for replacing ciphertexts with previous ciphertexts) will is overwhelming probability be rejected by the decryptor). $\endgroup$ – poncho Sep 14 '16 at 14:45
  • $\begingroup$ Thank you, I'll look into it. It may help us, although if it needs access to the key it may not be possible for us to use it. $\endgroup$ – Martin Kolinek Sep 14 '16 at 15:04
3
$\begingroup$

The communication between the device and the software can be intercepted and changed by the attacker.

Because of this, you really should use authenticated encryption (e.g. CCM).

Is it wrong to send a randomly generated value from the software to the device, hash it using SHA-256, and use that for the initialization vector?

For CBC, the IV needs to be unpredictable to an attacker. Hashing an attacker-known values doesn't make this value unpredictable, however if you encrypt the the value sent to your device using your AES engine, this value would be unpredictable and thus suitable as an IV for CBC.
Note though: CCM doesn't require an unpredictable IV and thus a simple (monotonic) counter would do, as long as the IV / nonce isn't re-used for the same key on either side.

$\endgroup$
  • $\begingroup$ Of course it needs to be unpredictable, I knew that... Thank you very much. The monotonic counter won't work for us as the key is shared between multiple devices. However, the encryption approach should work for us. $\endgroup$ – Martin Kolinek Sep 14 '16 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.