0
$\begingroup$
struct {
    opaque IV[SecurityParameters.record_iv_length];
    block-ciphered struct {
        opaque content[TLSCompressed.length];
        opaque MAC[SecurityParameters.mac_length];
        uint8 padding[GenericBlockCipher.padding_length];
        uint8 padding_length;
    };
} GenericBlockCipher;

I quoted above from RFC5246. I am curious why do we use IV like that. Why not derive IV in the key expansion and use it again again?

If we use it like above, the IV will be public to anybody. Is it right that the recipient should use the IV to decode block-ciphered struct? So IV is not encoded and only block ciphered struct is encoded.

$\endgroup$
  • 1
    $\begingroup$ The IV can be post-facto known (and is sent in clear in your quote) but must be unique and unpredictable for each message for CBC. SSL3 and TLS1.0 did derive the initial IV from the handshake (see >2246<) and then use the last block of each message as the IV for the next message, which could be eavesdropped enabling attacks culminating in BEAST about which we have numerous other Qs you can read, not to mention coverage all over the web in wikipedia and press sites and blogs and corporate sites etc etc. $\endgroup$ – dave_thompson_085 Sep 5 '18 at 0:40
3
$\begingroup$

I am curious why do we use IV like that. Why not derive IV in the key expansion and use it again again?

Repeating IVs is bad, both for CBC and GCM. And, no, keeping the repeated IV secret from the adversary doesn't help.

If we use it like above, the IV will be public to anybody.

Well, yes. IVs do not need to be secret; we don't mind if an adversary hears them.

Is it right that the recipient should use the IV to decode block-ciphered struct?

Yes. In CBC mode, the IV is directly used as the CBC-mode IV input (effectively, as the "previous ciphertext block" to decrypt the first ciphertext block). In GCM mode, it is combined with 4 bytes from the key expansion to generate a 12 byte nonce, which is used as the GCM-mode nonce input.

$\endgroup$
  • $\begingroup$ Thanks. But, what do you mean by 'previous cipher block to decrypt the first block' $\endgroup$ – Zeta Sep 5 '18 at 2:56
  • $\begingroup$ @Zeta: that's how CBC mode decryption works; plaintext block $P_i$ is computed $P_i = D_k( C_i ) \oplus C_{i-1}$, where $C_i$ is the ciphertext block $i$ and $C_{i-1}$ is the previous ciphertext block, For the first ciphertext block, $IV$ is used to stand in for $C_{i-1}$ $\endgroup$ – poncho Sep 5 '18 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.