I was trying to decrypt a text encrypted with AES and ECB mode.
I did try several keys and IV. I solved it by ignoring IV. (The IV was given, but it was maybe a distraction)
My question is in which cases IV is needed and in which is not?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ In all cases Alice and Bob use same algorithm (such as in Counter mode where Alice and Bob use Encryption), IV is a must. $\endgroup$ – hola 2 days ago
-
$\begingroup$ Can this question be generalised to other type of ciphers like stream, hash, MAC or AEAD? $\endgroup$ – hola 2 days ago
Add a comment
|
$\begingroup$
$\endgroup$
8
A quick list from Wikipedia;
- ECB : doesn't use IV and don't use ECB which is insecure, see the penguin from Wikipedia.
- CBC : uses IV
- PCB : uses IV
- CFB : uses IV
- CTR : uses IV
- OFB : uses IV
- GCM : uses IV
- CCM : uses IV
- ....
In short, all secure modes need an IV. To achieve semantical security the Probabilistic encryption is required.
-
2$\begingroup$ ECB is perfectly secure, arguably the most secure of all AES modes. As long as you don't go over 1 block, or all your data is patternless (eg random keys of another system or layer). $\endgroup$ – Agent_L Jan 28 '19 at 22:54
-
$\begingroup$ Deliberate use of all-zeros IV: tools.ietf.org/html/rfc4880#section-13.9 $\endgroup$ – Joshua Jan 28 '19 at 22:55
-
$\begingroup$ "ECB is perfectly secure arguably the most secure of all AES modes" is not correct. You could say ECB is secure if.... Moreover, ECB is not an authenticated mode where it will fail. $\endgroup$ – kelalaka Jan 29 '19 at 9:31
-
1$\begingroup$ You can safely use a null (all zero) IV for certain modes, like CTR, assuming you don't generate more than one keystream with the same key. Whether or not this counts as "using an IV" may be subjective... $\endgroup$ – forest Jan 30 '19 at 6:17
-
1$\begingroup$ @Agent_L It's also secure if it's used on top of another cipher which effectively guarantees that the plaintext will always be unique. For example, Salsa20/8 plus AES-ECB would be fine. Dunno why anyone'd do it. $\endgroup$ – forest Jan 30 '19 at 6:21
$\begingroup$
$\endgroup$
4
There is a mode of AES that can survive without an IV under certain assumptions.
https://en.wikipedia.org/wiki/Disk_encryption_theory#XTS
In particular, the XEX form of AES is designed to function in the absence of a working IV and in particular survives IV reuse. There's one downside in that if you do something like write enough data to the same block and an attacker can see all of the states the security collapses, but it's good it what it's designed for.
Looking for encryption algorithm not subject to known-plaintext attack with IV reuse
-
3
-
$\begingroup$ @kelaka: Which doesn't meet the definition of an IV because it is reused. You have to fill that AES register with something. $\endgroup$ – Joshua Jan 29 '19 at 14:28
-
$\begingroup$ The IV is $X$ which is generated from $X =E_k(sector\_number) \times \alpha^j$ $\endgroup$ – kelalaka Jan 29 '19 at 14:45
-
2$\begingroup$ @Joshua It doesn't matter if it's reused or not, as long as it's not reused with the same key. And the fact that XTS reuses an IV for a single sector is a problem and leaks data if an attacker has snapshots of the same sector over time as it is modified. It's still an IV though. $\endgroup$ – forest Jan 30 '19 at 6:19
$\begingroup$
$\endgroup$
There are modes that are "deterministic", in the sense that each invocation of encryption does neither depend on a random number generator for a random IV, nor depend on a state being kept for a nonce.
NIST SP 800-38F Key-wrapping mode is one such example, AES-GCM-SIV is another.
An earlier question has attracted some useful answers that may be helpful to readers of this question.
