Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using $IV = E_k^{-1}(c \oplus p)$?
$\begingroup$
$\endgroup$
1
-
1$\begingroup$ I generally appreciate improved typography, but the original question provided additional context about what the author's notion of CTR mode is and how the IV figures into the definition, and the answer below was written to match the author's original choice of notation. $\endgroup$– Squeamish OssifrageCommented Feb 23, 2019 at 18:55
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Correct.
Note that normally we use the term nonce rather than IV, because the only requirement for the nonce is that it never be repeated, while an IV (e.g., for CBC) must additionally be unpredictable in advance. Also usually you encrypt multiple 128-blocks in a single message by using E(nonce || 0, K), E(nonce || 1, K), E(nonce || 2, K), etc., as the pad, so you might get a nonce and a block counter.
answered Feb 23, 2019 at 14:17