1
$\begingroup$

16 bytes is the recommended entropy for the IV, AFAICT. Is 12 bytes of randomness with 4 fixed (across invocations of this encrypt function) bytes at the end, significantly worse? How so? What about 8 random bytes followed by 8 fixed bytes?

$\endgroup$
2
$\begingroup$

Decreasing entropy of IV doesn't just allow any attack. You can have IV entropy of 0 and if you send just one message using one key, you are safe as you used full 16bytes of entropy on IV. Deciding how big IV you need is based on how many messages attacker can see with same key and how big of problem such IV reuse is in your case.

But, as you send more messages smaller IV have problem that there is chance for collision in IV, which allows attacker to distinguish same starting blocks in ciphertext. So if you send two ciphertexts "message1" and "message2", attacker would be able to see that both ciphertexts started with some common start and then it changed. He won't be able to learn what that common start was, and if messages were same after first change, he won't be able to detect those. So it will only grant attacker minor help in breaking your cryptosystem.

Another problem that isn't directly related to size of IV, but it's predictability is choosen-plaintext attack. If your IV changes in predictable enough way and you have access to service that encrypts data with predictable IV, you can xor first block of your message with IV of message you wish to decrypt and with IV you predict to check if encrypted message was encrypted already. So if your IV is predictable, you can check if ciphertext X was encryption of plaintext P you have, even if they have different IV's.

So basic problem with smaller IV is that you increase chance that you will reuse it, which is only small problem in cbc. You should too make steps to make sure it isn't predictable. But beware: IV reuse attacks can be far more devastating, for example in ctr mode.

$\endgroup$
2
  • 1
    $\begingroup$ Predictable (or semipredictable) IV's also have a problem with chosen plaintext attacks; that should be mentioned as well... $\endgroup$ – poncho Nov 22 '16 at 13:05
  • $\begingroup$ you are right, I'll add that soon. Thanks for reminding. $\endgroup$ – axapaxa Nov 22 '16 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.