# What size of initialization vector (IV) is needed for AES encryption?

What size of initialization vector (IV) is needed for AES encryption? I am using either CBC or CFB modes.

Knowing that AES is a sysmmetrical block-cipher algorithm with a 128-bit block size, I think the answer for IV is still 16 bytes or 128 bits for AES 128, 192 and 256.

Reading this stackoverflow Q&A it seems as if the size of the IV is the size of the block which is always 128 bit (= 16 bytes) in AES, even if the keysize is larger than the block size. Is that correct?

• You are correct, it is 16 bytes, identical to the block size regardless of the key size. Aug 11, 2017 at 17:36
• yes, IV is always equal to block size. Aug 11, 2017 at 19:16
• Remember that the IV is not secret, but it should still have the properties as described in Squeamish Ossifrage's answer. You must use the exact same IV during encryption and decryption (of the same message). Usually, it is simply prepended to the ciphertext during encryption and sliced off during decryption. Aug 12, 2017 at 13:14
• Two notes: (1) Although it is practical for the key size to be related to the block size (e.g. when wrapping or deriving a sub-key) there is no direct link between the two. Therefore the IV is not linked to the key size for most block cipher modes of operation. (2) The mode of operation determines the size of the IV. This is usually the same as the block size but it doesn't have to be. For instance, for (AES-)GCM the default IV size is 12 bytes. Aug 12, 2017 at 13:54

All that said, could I interest you in an authenticated encryption scheme instead, such as NaCl crypto_secretbox_xsalsa20poly1305? Or, if you find yourself reaching for the letters ‘AES’ and ‘CBC’, you're probably lost in a vat of acronym soup and you may need help navigating crypto protocols more than you need help picking the right parameter sizes for a confusing crypto API that asks you to choose mode and then specify IV.