# Using a non-secure random generator for IV or salt generation

I was just looking at a post on Code Review when I noticed the other answer to the post. While I would agree mostly with the answer, I do however doubt if having a Cryptographically Secure PRNG is really an issue for generating IV's and salt values (where the salt is used for password based key derivation).

What would be the requirements on the random number generator to be used for IV and salt generation? Would a uniquely seeded, well distributed, non-secure RNG suffice?

• I predict that the word "predict" will be used in the answers ;) – Maarten Bodewes May 8 at 16:07

Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $$\mathit{iv}_0$$, which is $$\operatorname{AES}_k(\mathit{iv}_0 \oplus \mathit{iv}_0) = \operatorname{AES}_k(0)$$, and proceed by asking to be challenged on the messages $$m_0 = \mathit{iv}_1$$ and $$m_1 = \mathit{iv}_1 \oplus 1$$ (or any message distinct from $$\mathit{iv}_1$$). If I get back $$\operatorname{AES}_k(0)$$ as the ciphertext for $$m_b$$ for unknown $$b$$, then $$b$$ must have been 0; otherwise 1. Hence if the IV is predictable in advance, AES-CBC is an insecure cipher—specifically, it fails the standard of IND-CPA.