for a protocol which implements AES under CBC mode, an $IV $(initialization vector) is required for each encryption. Instead of picking the $IV$ randomly, is it advisable for us to set the $IV$ to be $\text{SHA1}(k||m)$ where $k$ is the key, and $m$ is the $1^{st}$ 128 bits of the plaintext, e.g is this scheme semantically secure? Any thoughts is welcome! Thanks!
$\begingroup$
$\endgroup$
4
-
$\begingroup$ Does this mean that if you send two different messages with the same initial 128 bits, the IV that both messages will use will be the same? $\endgroup$– ponchoCommented Nov 16, 2016 at 15:10
-
$\begingroup$ @poncho: Yes you are right! $\endgroup$– meta_warriorCommented Nov 16, 2016 at 15:11
-
$\begingroup$ Is it not just as easy to generate a random IV for each one. Perhaps elaborate on what problem you are trying to solve - for example are you worried about being able to generate crypto random numbers for the IV? $\endgroup$– dave.zapCommented Nov 16, 2016 at 15:35
-
$\begingroup$ @dave.zap: I am just thinking if the scheme is semantically secure in this scenario? $\endgroup$– meta_warriorCommented Nov 16, 2016 at 15:42
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
0
No, it's not semantically secure.
Proof: select two plaintexts with identical initial 128 bits; and present them to the Oracle to be encrypted. The resulting ciphertexts will also have identical initial 128 bits, hence the encryptor can be distinguished from something that generates random outputs.
$\begingroup$
$\endgroup$
4
If you use the entire message and a collision resistant hash function, you can get some form of security, but not IND-CPA (equivalent to semantic security). The IND-CPA game is mostly used with public key encryption, and with symmetric encryption the attacker is given access to an encryption oracle. Then any kind of deterministic encryption automatically fails, because the attacker can just ask the oracle for encryptions for both ciphertexts and the challenge is one of those.
If you make the attacker weaker by not allowing the attacker to query the chosen plaintexts, this would work. ´But I don't think this is actually a commonly used security definition.
If you just have preimage resistance and no collision resistance, there might be other problems - but that depends on how collisions can be found, which makes formal analysis difficult.
But the point about collision resistance is a strong case against SHA-1, which has been considered broken for a long time w.r.t. collision resistance. (And now in Feb 2017, a collision was found). And in general, a new protocol should never be build on outdated (almost obsolete) cryptographic functions.
- This question adresses when it is okay to use SHA-1 and when not.
- This article by Bruce Schneier from 2012 is also quite interesting, stating a complexity of roughly $2^{60}$ to find a collision.
- And the here you can see that the bitcoin network hash rate is around $2 \cdot 10^{18} \approx 2^{60.79}$ per second (even if other specialized hardware would be required, because they do SHA 256 hashes)
-
$\begingroup$ Even if you use the entire message, you will still always produce the same cipher text for a given plain text. That means if Eve sees the same cipher text going past twice (and knows the key hasn't changed), she can know that the same plain text was sent. That can be a problem. $\endgroup$ Commented Feb 27, 2017 at 16:21
-
$\begingroup$ @MartinBonner You're right, that it has the same weakness as ECB mode of operation (and any other form of deterministic encryption). However, it doesn't imply an attack on the IND-CPA game (equivalent to semantic security) directly: The attacker chooses two messages and has to find out which one was encrypted. If he sends two equal messages, then he can only guess - that doesn't help. $\endgroup$– tyloCommented Feb 27, 2017 at 16:44
-
$\begingroup$ Ah ha! Thanks for clarifying that. So I was right to feel twitchy (beyond "don't invent new modes"), but the question as asked was rather specific. $\endgroup$ Commented Feb 27, 2017 at 16:46
-
$\begingroup$ @MartinBonner Actually I have to retract my statement. IND-CPA is most commonly used with public key cryptosystems, and there are a couple of questions here, e.g. here. If you grant the attacker access to an encryption oracle for any plaintexts, any kind of deterministic encryption fails. $\endgroup$– tyloCommented Feb 27, 2017 at 17:13