I have 2 questions regarding security issues related to initialization vectors used in AES CBC
- Consider that I'm using a sequence number (which increments with every encryption) as an initialization vector. Would this be a security issue? Is there some way that an attacker who knows the sequence numbers and in turn knows the IV, be able to decrypt even some part of the data, if not the whole?
I'm asking this question because some of the comments on the 1st answer in the following link seem to suggest that using a counter for an IV would not be a good choice.
If it is possible to perform such an attack, can you provide an explanation of how this would be possible? I tried searching. But, none of the sources I found seem to answer why the IV cannot take values from a counter. They only talk about safety in terms of storage.
- The other question is related to transmission of IVs. I searched quite a bit and everyone says that the IV need not be secret. But, if IV is exposed, isn't it possible for a man in the middle to change the IV so that the end result at the decryption end will fail?