This question already has an answer here:


IV is sha512 of key.

Ek[random padding | message | random padding]

How much information would be leaked from the use of the same IV & key in this way, assuming the adversary has complete access to the system, design, iv, and all information, the AES Object itself, etc etc, except the key?


marked as duplicate by Gilles 'SO- stop being evil', Ella Rose, Maarten Bodewes, e-sushi Aug 1 '18 at 4:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


If the initial "random padding" is (at least) 16 bytes, this is effectively CBC mode with a random IV.

That's because the initial block of the ciphertext is, with your scheme:

$$E_k( \text{IV} \oplus \text{Random Padding} )$$

which is equidistributed among all $2^{128}$ possible values (assuming Random Padding is equidistributed among all $2^{128}$ possible values independent of the IV).

The rest of the ciphertext is effectively the CBC mode encryption of the rest of the plaintext, with the above equidistributed value as the IV


Not the answer you're looking for? Browse other questions tagged or ask your own question.