If we consider the generation of keys as

$$\begin{aligned} K_0 &= E_K(IV); \\ K_{i+1} &= E_{K_i}(A) \end{aligned}$$

Where A is a block of zeroes, and the ciphertext blocks are computed as

$$C_i = E_{K_i}(P_i), \quad i \in \{0, 1, 2, \dots\},$$

is there any problem when we encrypt the same message twice with the same key $K$ and different $IV$?

  • 1
    $\begingroup$ What is A? And is this an actual encryption scheme used (or intended to be used) somewhere or just a random exercise? (Also, I edited your question to typeset the math better. Please check that I didn't introduce any mistakes in the process, as there were a few places where I had to guess what you intended.) $\endgroup$ – Ilmari Karonen Jun 10 '19 at 15:47
  • $\begingroup$ A is block of zeroes $\endgroup$ – le19 Jun 10 '19 at 15:53
  • 3
    $\begingroup$ An obvious problem with your scheme is that if $P_i = A$ for any $i$, then the remainder of the message can be decrypted without knowing the key. But that has nothing to do with encrypting the same message twice. $\endgroup$ – Ilmari Karonen Jun 10 '19 at 15:57
  • $\begingroup$ Why? I don't understand it, if each Ki will be different right? Thak you! $\endgroup$ – le19 Jun 10 '19 at 16:12
  • 2
    $\begingroup$ If $P_i = A$, then $C_i = E_{K_i}(A) = K_{i+1}$. So if this happens, the scheme leaks $K_{i+1}$ and lets anyone with the ciphertext generate all the later subkeys. $\endgroup$ – Ilmari Karonen Jun 10 '19 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.