0
$\begingroup$

I want to store private keys in the database. I will never store the same private keys twice. As I understand the only reasons behind using a unique IV for each encryption, is that attacker can't see that you have the same data twice.

My server is generating the private keys. My server ensures that each private key will be only once in the database. If so, should I use an IV?

Improve this question
$\endgroup$
1
  • $\begingroup$ What will the symmetric encryption scheme be? ​ ​ $\endgroup$
    – user991
    Jan 15, 2018 at 14:31

2 Answers 2

Reset to default
2
$\begingroup$

If you are encrypting keys, then you should use a key wrapping method. The SIV standard is the best for this.

Regarding doing something ad-hoc and without an IV, it really depends on the mode of operation. But, I always recommend against doing something non-standard.

Improve this answer
$\endgroup$
1
$\begingroup$

In support of Yehuda's answer, I would like to show that re-using a IV is very dangerous when it comes to encrypting private keys:

  • say that you are using CBC mode encryption: you would be able to distinguish between private keys that start with the same bytes. Usually the keys are encoded in some way. So it could be that e.g. 4 bytes are encrypted in the block. If you would find the same ciphertext block you would know that the 4 bytes of the two keys are identical;

  • if you are using CTR mode then the situation becomes worse: you could XOR to see which bits are identical or not. If party A would expose the private exponent somehow then the key of party B would become compromised as well. If party A knows the value of his own private key (not a given when e.g. a hardware device is used) then it also can decrypt the private key of party B.

A synthetic-IV mode (deterministic encryption) would work better as it let the IV on the entire plaintext. That way you can only distinguish exact duplicates.

So you should use a wrapping mode that allows for deterministic encryption. You should definitely make sure that the IV complies to the requirements of the mode of operation (CBC, CTR) to create a CPA secure cipher.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ Many HSM's allow for "wrapping modes" that consist of 3DES in ECB mode. I'll not go into the utter stupidity of using that with ASN.1 encoded private keys. It's OK-ish for fully randomized symmetric keys, but not for keys that also contain known plaintext. $\endgroup$
    – Maarten Bodewes ♦
    Jan 15, 2018 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.