1
$\begingroup$

I was trying to decrypt a text encrypted with AES and ECB mode.

I did try several key and IV. I solved it by ignoring IV. (The IV was given, but it was maybe a distractor)

My question is in which cases IV is needed and in which is not?

|improve this question
$\endgroup$
4
$\begingroup$

A quick list from Wikipedia;

  • ECB : doesn't use IV and don't use ECB which is insecure, see the penguin from Wikipedia.
  • CBC : uses IV
  • PCB : uses IV
  • CFB : uses IV
  • CTR : uses IV
  • OFB : uses IV
  • GCM : uses IV
  • CCM : uses IV
  • ....

In short, all secure modes need an IV. To achieve semantical security the Probabilistic encryption is required.

|improve this answer
$\endgroup$
  • 2
    $\begingroup$ ECB is perfectly secure, arguably the most secure of all AES modes. As long as you don't go over 1 block, or all your data is patternless (eg random keys of another system or layer). $\endgroup$ – Agent_L Jan 28 at 22:54
  • $\begingroup$ Deliberate use of all-zeros IV: tools.ietf.org/html/rfc4880#section-13.9 $\endgroup$ – Joshua Jan 28 at 22:55
  • $\begingroup$ "ECB is perfectly secure arguably the most secure of all AES modes" is not correct. You could say ECB is secure if.... Moreover, ECB is not an authenticated mode where it will fail. $\endgroup$ – kelalaka Jan 29 at 9:31
  • 1
    $\begingroup$ You can safely use a null (all zero) IV for certain modes, like CTR, assuming you don't generate more than one keystream with the same key. Whether or not this counts as "using an IV" may be subjective... $\endgroup$ – forest Jan 30 at 6:17
  • 1
    $\begingroup$ @Agent_L It's also secure if it's used on top of another cipher which effectively guarantees that the plaintext will always be unique. For example, Salsa20/8 plus AES-ECB would be fine. Dunno why anyone'd do it. $\endgroup$ – forest Jan 30 at 6:21
1
$\begingroup$

There is a mode of AES that can survive without an IV under certain assumptions.

https://en.wikipedia.org/wiki/Disk_encryption_theory#XTS

In particular, the XEX form of AES is designed to function in the absence of a working IV and in particular survives IV reuse. There's one downside in that if you do something like write enough data to the same block and an attacker can see all of the states the security collapses, but it's good it what it's designed for.

Looking for encryption algorithm not subject to known-plaintext attack with IV reuse

|improve this answer
$\endgroup$
  • 2
    $\begingroup$ XTS uses sector numbers as an IV. $\endgroup$ – kelalaka Jan 29 at 9:26
  • $\begingroup$ @kelaka: Which doesn't meet the definition of an IV because it is reused. You have to fill that AES register with something. $\endgroup$ – Joshua Jan 29 at 14:28
  • $\begingroup$ The IV is $X$ which is generated from $X =E_k(sector\_number) \times \alpha^j$ $\endgroup$ – kelalaka Jan 29 at 14:45
  • 1
    $\begingroup$ @Joshua It doesn't matter if it's reused or not, as long as it's not reused with the same key. And the fact that XTS reuses an IV for a single sector is a problem and leaks data if an attacker has snapshots of the same sector over time as it is modified. It's still an IV though. $\endgroup$ – forest Jan 30 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.