# Given the key, the plain text and the cipher text can I calculate the IV used in CBC mode?

If I have the plain text, the ciphertext and the key for an AES-128 CBC operation, can I determine the IV, even if I don't know the padding (assuming the padding follows one of the more common formats)?

I believe it should be possible since my understanding is that the IV is only used as an initial XOR of the plain text in encryption, and should, therefore, be able to be available like this:

AESDecrypt(key, ciphertext) => (PlainText XOR IV);
IV = ((Plaintext XOR IV) XOR (Plaintext))


Is this correct?

• A thought. In some cases the IV is prepended to the cyphertext. This may be the case here. To check, use the first 8 bytes as the IV to decrypt the rest of the encrypted message. – rossum Dec 14 '19 at 11:37

It is simple.

Just decrypt first 8 bytes encrypted buffer(1 block) in ECB mode (You only need encrypted buffer and key to do so) and then xor the result with the input buffer. Result will be IV.

In decryption of CBC, IV just affect first block. That's why only first block is incorrect in your case.

can I determine the IV

In CBC block cipher mode of operation, not restricted for AES, the decryption of the first block is

$$P_1=Dec(K,C_1)\oplus \text{IV}$$

Where $$P_1$$ is the first plaintext and $$C_1$$ its encryption of $$P_1$$ with the key $$K$$ under the CBC mode of operation. Therefore

$$\text{IV} = P_1 \oplus Dec(K,C_1)$$

even if I don't know the padding

If you know the plaintext, there are some standard padding schemes that you can use to determine the IV, like

If the plaintext is more than one block, you don't need to consider the padding for calculation of the IV. The first plaintext block will be enough to calculate the IV.

The IV is only used as an initial XOR of the plain text in encryption

Shortly, yes. Longly; the CBC is a propagation mode, encryption process in CBC mode is performed as

\begin{align} C_1 &= Enc_k(P_1 \oplus IV)\\ C_i &= Enc_k(P_i \oplus C_{i-1}),\;\; 1 < i \leq nb, \end{align} where $$nb$$ is the number of blocks. The IV is for the first block, and the rest encryption is using the previous ciphertext for the IV, chaining.

Decryption process in CBC mode is performed as \begin{align} P_1 =& Dec_k(C_1) \oplus IV\\ P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb, \end{align} where $$nb$$ is the number of blocks.

Although the IV is used only in the first block, it affects all other blocks - propagation. We can see this better if we expand the equations for encryption

$$C_j = Enc_k(P_j \oplus Enc_k(P_{j-1} \oplus \cdots Enc_k(P_1 \oplus IV)\cdots)).$$