I was trying to decrypt a text encrypted with AES and ECB mode.
I did try several keys and IV. I solved it by ignoring IV. (The IV was given, but it was maybe a distraction)
My question is in which cases IV is needed and in which is not?
$\begingroup$
$\endgroup$
2
asked Jan 28, 2019 at 18:56
-
$\begingroup$ In all cases Alice and Bob use same algorithm (such as in Counter mode where Alice and Bob use Encryption), IV is a must. $\endgroup$– holaCommented Feb 26, 2021 at 2:11
-
$\begingroup$ Can this question be generalised to other type of ciphers like stream, hash, MAC or AEAD? $\endgroup$– holaCommented Feb 26, 2021 at 2:12
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
8
A quick list from Wikipedia;
- ECB : doesn't use IV and don't use ECB which is insecure, see the penguin from Wikipedia.
- CBC : uses IV
- PCB : uses IV
- CFB : uses IV
- CTR : uses IV
- OFB : uses IV
- GCM : uses IV
- CCM : uses IV
- ....
In short, all secure modes need an IV. To achieve semantical security the Probabilistic encryption is required.
answered Jan 28, 2019 at 19:10
-
2$\begingroup$ ECB is perfectly secure, arguably the most secure of all AES modes. As long as you don't go over 1 block, or all your data is patternless (eg random keys of another system or layer). $\endgroup$– Agent_LCommented Jan 28, 2019 at 22:54
-
$\begingroup$ Deliberate use of all-zeros IV: tools.ietf.org/html/rfc4880#section-13.9 $\endgroup$– JoshuaCommented Jan 28, 2019 at 22:55
-
$\begingroup$ "ECB is perfectly secure arguably the most secure of all AES modes" is not correct. You could say ECB is secure if.... Moreover, ECB is not an authenticated mode where it will fail. $\endgroup$– kelalakaCommented Jan 29, 2019 at 9:31
-
1$\begingroup$ You can safely use a null (all zero) IV for certain modes, like CTR, assuming you don't generate more than one keystream with the same key. Whether or not this counts as "using an IV" may be subjective... $\endgroup$– forestCommented Jan 30, 2019 at 6:17
-
1$\begingroup$ @Agent_L It's also secure if it's used on top of another cipher which effectively guarantees that the plaintext will always be unique. For example, Salsa20/8 plus AES-ECB would be fine. Dunno why anyone'd do it. $\endgroup$– forestCommented Jan 30, 2019 at 6:21
$\begingroup$
$\endgroup$
4
There is a mode of AES that can survive without an IV under certain assumptions.
https://en.wikipedia.org/wiki/Disk_encryption_theory#XTS
In particular, the XEX form of AES is designed to function in the absence of a working IV and in particular survives IV reuse. There's one downside in that if you do something like write enough data to the same block and an attacker can see all of the states the security collapses, but it's good it what it's designed for.
Looking for encryption algorithm not subject to known-plaintext attack with IV reuse
-
3$\begingroup$ XTS uses sector numbers as an IV. $\endgroup$– kelalakaCommented Jan 29, 2019 at 9:26
-
$\begingroup$ @kelaka: Which doesn't meet the definition of an IV because it is reused. You have to fill that AES register with something. $\endgroup$– JoshuaCommented Jan 29, 2019 at 14:28
-
$\begingroup$ The IV is $X$ which is generated from $X =E_k(sector\_number) \times \alpha^j$ $\endgroup$– kelalakaCommented Jan 29, 2019 at 14:45
-
2$\begingroup$ @Joshua It doesn't matter if it's reused or not, as long as it's not reused with the same key. And the fact that XTS reuses an IV for a single sector is a problem and leaks data if an attacker has snapshots of the same sector over time as it is modified. It's still an IV though. $\endgroup$– forestCommented Jan 30, 2019 at 6:19
$\begingroup$
$\endgroup$
There are modes that are "deterministic", in the sense that each invocation of encryption does neither depend on a random number generator for a random IV, nor depend on a state being kept for a nonce.
NIST SP 800-38F Key-wrapping mode is one such example, AES-GCM-SIV is another.
An earlier question has attracted some useful answers that may be helpful to readers of this question.
