Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using $IV = E_k^{-1}(c \oplus p)$?

  • 1
    $\begingroup$ I generally appreciate improved typography, but the original question provided additional context about what the author's notion of CTR mode is and how the IV figures into the definition, and the answer below was written to match the author's original choice of notation. $\endgroup$ – Squeamish Ossifrage Feb 23 '19 at 18:55


Note that normally we use the term nonce rather than IV, because the only requirement for the nonce is that it never be repeated, while an IV (e.g., for CBC) must additionally be unpredictable in advance. Also usually you encrypt multiple 128-blocks in a single message by using E(nonce || 0, K), E(nonce || 1, K), E(nonce || 2, K), etc., as the pad, so you might get a nonce and a block counter.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.