# Longer IV generation from a single block IV for ICBC

I was reading a question about ICBC here and it mentioned that you would need a $$s \cdot n$$-bit $$IV$$ if you would use $$s$$ "stripes", where $$n$$ is the blocksize.

Say that we don't like transmit that amount of data, would it then be safe to use the following generation of $$IV'$$ for ICBC, so we can use an $$n$$-bit $$IV$$ again?

$$IV' = \operatorname{CBC}_k(0^n, IV \| 0^{(s - 1) \cdot n})$$

I think it is secure (other than that the amount of data that can be securely encrypted is diminished by the amount of data that is encrypted for $$IV'$$, but that's as good as negligible, I suppose).

Of course, we assume the normal CBC conditions regarding unpredictability for the $$IV$$ in the scheme.

I'm reading the question's suggestion as using $$\text{IV'}_0=\text{ENC}_k(\text{IV})$$ as the Initialisation Vector for stripe $$0$$ and for $$0 using $$\text{IV'}_i=\text{ENC}_k(\text{IV'}_{i-1})$$ as the IV for stripe $$i$$.

That's not (CPA) secure, because it allows distinguishing that the plaintext starts with zero blocks: in that case, the second ciphertext block of stripe $$0$$ will be the same as the first ciphertext block of stripe $$1$$.

Addition: I do not immediately see an attack¹ if we build the IVs as $$\text{IV'}_0=\text{IV}$$, $$\text{IV'}_i=\text{ENC}_k(\text{IV'}_{i-1})\oplus\text{IV}$$. Or this slightly different option, using the question's notation: $$\text{IV'} = \operatorname{CBC}_k(\text{IV},\text{IV}^s)$$

¹ which is not a conjecture of security.

• Why not directly, $IV+i$ where $i$ is the stripe number. Feb 12, 2020 at 20:25
• @kelalaka: that allows a distinguisher too. For example, set the first data block of each stripe equal to the stripe number, and with fair probability the first ciphertext block of some stripes are equal.
– fgrieu
Feb 12, 2020 at 20:55