What size of initialization vector (IV) is needed for AES encryption? I am using either CBC or CFB modes.

Knowing that AES is a sysmmetrical block-cipher algorithm with a 128-bit block size, I think the answer for IV is still 16 bytes or 128 bits for AES 128, 192 and 256.

Reading this stackoverflow Q&A it seems as if the size of the IV is the size of the block which is always 128 bit (= 16 bytes) in AES, even if the keysize is larger than the block size. Is that correct?

  • 6
    $\begingroup$ You are correct, it is 16 bytes, identical to the block size regardless of the key size. $\endgroup$
    – Xander
    Aug 11 '17 at 17:36
  • $\begingroup$ yes, IV is always equal to block size. $\endgroup$
    – crypt
    Aug 11 '17 at 19:16
  • $\begingroup$ Remember that the IV is not secret, but it should still have the properties as described in Squeamish Ossifrage's answer. You must use the exact same IV during encryption and decryption (of the same message). Usually, it is simply prepended to the ciphertext during encryption and sliced off during decryption. $\endgroup$
    – Artjom B.
    Aug 12 '17 at 13:14
  • 1
    $\begingroup$ Two notes: (1) Although it is practical for the key size to be related to the block size (e.g. when wrapping or deriving a sub-key) there is no direct link between the two. Therefore the IV is not linked to the key size for most block cipher modes of operation. (2) The mode of operation determines the size of the IV. This is usually the same as the block size but it doesn't have to be. For instance, for (AES-)GCM the default IV size is 12 bytes. $\endgroup$
    – Maarten Bodewes
    Aug 12 '17 at 13:54

For both CBC mode and CFB mode, the initialization vector is the size of a block, which for AES is 16 bytes = 128 bits. For CFB mode, the IV must never be reused for different messages under the same key; for CBC mode, the IV must never be reused for different messages under the same key, and must be unpredictable in advance by an attacker. Using successive integers as the IV is fine for CFB but not fine for CBC.

Beware: The Wikipedia articles are currently (2017-08-11) full of archaic drivel about self-synchronizing ciphers and error propagation and other fortunately forgotten relics of the dark ages of crypto engineering from a bygone century. I cite them only for the easily accessible statements of equations relating plaintext and ciphertext and their associated diagrams.

All that said, could I interest you in an authenticated encryption scheme instead, such as NaCl crypto_secretbox_xsalsa20poly1305? Or, if you find yourself reaching for the letters ‘AES’ and ‘CBC’, you're probably lost in a vat of acronym soup and you may need help navigating crypto protocols more than you need help picking the right parameter sizes for a confusing crypto API that asks you to choose mode and then specify IV.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.