Longer IV generation from a single block IV for ICBC

Question

I was reading a question about ICBC here and it mentioned that you would need a $s \cdot n$-bit $IV$ if you would use $s$ "stripes", where $n$ is the blocksize.

Say that we don't like transmit that amount of data, would it then be safe to use the following generation of $IV'$ for ICBC, so we can use an $n$-bit $IV$ again?

$$IV' = \operatorname{CBC}_k(0^n, IV \| 0^{(s - 1) \cdot n})$$

I think it is secure (other than that the amount of data that can be securely encrypted is diminished by the amount of data that is encrypted for $IV'$, but that's as good as negligible, I suppose).

Of course, we assume the normal CBC conditions regarding unpredictability for the $IV$ in the scheme.

Answer 1

I'm reading the question's suggestion as using $\text{IV'}_0=\text{ENC}_k(\text{IV})$ as the Initialisation Vector for stripe $0$ and for $0<i<s$ using $\text{IV'}_i=\text{ENC}_k(\text{IV'}_{i-1})$ as the IV for stripe $i$.

That's not (CPA) secure, because it allows distinguishing that the plaintext starts with zero blocks: in that case, the second ciphertext block of stripe $0$ will be the same as the first ciphertext block of stripe $1$.

Addition: I do not immediately see an attack¹ if we build the IVs as $\text{IV'}_0=\text{IV}$, $\text{IV'}_i=\text{ENC}_k(\text{IV'}_{i-1})\oplus\text{IV}$. Or this slightly different option, using the question's notation: $$\text{IV'} = \operatorname{CBC}_k(\text{IV},\text{IV}^s)$$

---

¹ which is not a conjecture of security.