2
$\begingroup$

My secret message is encrypted in a byte buffer with AES-128 in CBC mode. The first 16 bytes are the IV and the message follows contiguously. If I want to securely delete this message is it enough to delete (overwrite with random) the IV, the first block, or both?

In an answer to similar post (crypto shredding by erasing the IV instead of the key) it was suggested that if the key and one plain-text block is known then the entire message can be recovered. So it may be better to overwrite the entire secret message...

However, if the secret key has been forgotten decryption is impossible and so the length of the encrypted message is unknown. There may be circumstances where overwriting the entire is undesirable.

Improve this question
$\endgroup$
  • 1
    $\begingroup$ If you were planning ahead for such a scenario en.wikipedia.org/wiki/All-or-nothing_transform $\endgroup$ – daniel Dec 29 '18 at 11:24
  • $\begingroup$ Interesting idea - are there any (preferably open source C) known imlementations? $\endgroup$ – DrPhill Dec 29 '18 at 11:56
3
$\begingroup$

If I want to securely delete this message is it enough to delete (overwrite with random) the IV, the first block, or both?

No, it's not enough. Not even if you erase both.

(Not unless your message is at most two blocks long, that is.)

Erasing the IV makes the first block of the message undecryptable. Erasing the IV and the first $n$ blocks of ciphertext makes the first $n+1$ blocks undecryptable. In either case, the rest of the message can still be decrypted normally.

For modes other than CBC, the details may vary, but for all commonly used modes the conclusion remains the same: to ensure that no part of the message can be decrypted even if the key is compromised, you will need to erase the entire ciphertext (or the IV and almost all of the ciphertext, at least).

Improve this answer
$\endgroup$
  • $\begingroup$ Ah.... I think I see the error in my thinking. Is it that the output from block n is used as the IV for block n+1, simply to make sure that the starting conditions for block n+1 is unique? The changeing starting conditions are designed to make key-deduction harder. But if the key is available then the output of block n together with the key is enough to decrypt block n+1. Is my understanding now correct? $\endgroup$ – DrPhill Dec 28 '18 at 16:07
  • 1
    $\begingroup$ @DrPhill: Yes, exactly. (Well, except for the "to make key-deduction harder" part. The key is protected by the design of AES itself, regardless of what mode it's used in. But XORing the plaintext with the previous block's ciphertext and using a random IV to start the chain make it harder -- in a specific, provable sense -- to deduce anything about the plaintext from just seeing the ciphertext, even if the plaintext might be highly repetitive.) $\endgroup$ – Ilmari Karonen Dec 28 '18 at 16:21
  • $\begingroup$ Stupid idea: you could securely destroy every even or every odd block (destroying the IV for the odd blocks as well if you start counting at zero). That way, for CBC, you would not have enough info to retrieve the plaintext. Beats me why you would want to do that, but there it is. $\endgroup$ – Maarten Bodewes♦ Dec 29 '18 at 2:35
  • $\begingroup$ @MaartenBodewes: If you knew (or guessed) the plaintext for a block, that would still let you decrypt at least one adjacent block. (Other than that, though, it does seem to obscure the message pretty effectively. At least I can't think of any obvious attacks that wouldn't involve either effectively guessing a whole block of plaintext or somehow exploiting a flaw in the block cipher itself.) $\endgroup$ – Ilmari Karonen Dec 29 '18 at 6:20
  • $\begingroup$ No such thing as a stupid idea (unless you act on it of course). My problem here is that I have a byte buffer extracted from a jpeg, and it may contain more than one encrypted message. I was hoping that, knowing the start position then I could safely erase a message by erasing the IV and first block. I was wrong in the case where the pasword has been comprimised. Which is useful to know. $\endgroup$ – DrPhill Dec 29 '18 at 11:53
1
$\begingroup$

First of all, When you have the encryption key, deleting the IV in CBC mode can only prevent the decryption of the first block.

\begin{align} p_0 =& Dec_k(c_0) \oplus IV\\ p_i =& Dec_k(c_i) \oplus c_{i-1} \end{align} The rest of the blocks can be decrypted.

Assuming that you have don't have the encryption key anymore (forgotten), the IV is deleted, and we have only the ciphertexts around, then the only attack for AES-128 is cyphertext only attack by brute-force.

To achieve this, one can try all possible keys and try to see meaningful text and decrypt other blocks with the probable key to see that it is continuing. The search space $2^{128}$ is out of reach for near future. If this attack is somehow successful then the lack of IV will prevent only the decryption of the first block. So, as long as AES secure, you can leave it as it is.

Note: to be secure, one needs to prefer shredding as much as possible.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.