Actually, I think IV (initialization vector) is random number which is same size as the other block of plaintext. But if the IV is corrupted, message cannot be decrypted because original IV used to encrypt doesn't exist so it actually cannot recover the message from ciphertext.

Is it right?

  • $\begingroup$ Why don't you start with the definition of CBC, and see where that takes you? In particular, write out the equation relating blocks of ciphertext and blocks of plaintext, and maybe draw a diagram with arrows that show the relation between blocks of ciphertext and blocks of plaintext and where the IV figures in. $\endgroup$ – Squeamish Ossifrage Oct 19 '19 at 13:46

If the IV is send with the ciphertext rather than derived (this seems assumed, otherwise the IV is unlikely to get corrupted) and is indeed fully unpredictable the those bits that are affected cannot be decrypted (presuming that the bits are changed with a 50% chance). This is because decryption of the first block of CBC depends on a XOR with the IV to derive the plaintext. If the value of any of the IV bits is unknown, then the value of the plaintext is unknown as well, similar to the way a one-time-pad works.

However, the decryption of the other, unaffected bits is still fully possible. And any block after that only relies on the ciphertext block before it, rather than the IV. So most of the message would still be recoverable, regardless of what happens to the IV.

So basically, the answer is no this is not correct other than for the bits in the first block of the ciphertext / plaintext that are affected by the changes in the IV.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.