I want to encrypt 128 bits of data. I understand the problem with ECB, so I generate a 128-bit Initialization Vector to use for encryption and send with the encrypted data. Is there a "best" way to apply this IV?

The Block Cipher Modes of Operation can use the IV in a couple of ways:

  • The IV is XOR'd with the payload, then this is used as the plaintext for AES, then the AES output is the ciphertext.

  • The IV is the plaintext for AES, and the output is XOR'd with the payload, then this is the ciphertext.

My system is not concerned with a stream of data, only a single 128-bit block. The receiver can never be expected to have received a prior 128-bit message. So, the modes of operation (CBC, CTR, GCM, etc.) are not fully applicable.

Are each of these functionally the same for that single block? Instead of applying the IV "before" or "after" as above, what if I XOR'd the key with the IV?


1 Answer 1


Yes there are differences.

The first one is identical to CBC mode encryption. CBC requires an IV that is indistinguishable from random to an adversary.

The second is identical to CTR mode encryption where the IV is the initial counter value; the IV only needs to be unique - but the IV can be randomized, as a 128 bit random number is unlikely to repeat.

You never want to do anything to your key other than using it for your cipher. If you want to create multiple keys, use a Key Based Key Derivation Function such as HKDF rather than XOR.

Note that generally you should try and find the best mode for your operation, and only then generate your IV using the rules for that specific mode.

Authenticated encryption using an AEAD cipher such as AES in GCM mode often makes a lot of sense. GCM for instance generally uses a 96 bit IV / nonce instead of a 128 bit IV.

  • $\begingroup$ Edited my question to clarify the "single block". It sounds like a random IV fulfills both of the expansions that would make CBC and CTR; and therefore, for practical purposes, be functionally equivalent for the first block. $\endgroup$
    – Sarkreth
    Sep 30, 2018 at 3:12
  • $\begingroup$ Yep, random IV's are kind of the default, as you don't need to keep state. If you really only use your key once then you don't need an IV. $\endgroup$
    – Maarten Bodewes
    Sep 30, 2018 at 3:23
  • $\begingroup$ Edit that comment into your answer and I'll "accept" it. $\endgroup$
    – Sarkreth
    Sep 30, 2018 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.