I was reading a question about ICBC here and it mentioned that you would need a $s \cdot n$-bit $IV$ if you would use $s$ "stripes", where $n$ is the blocksize.

Say that we don't like transmit that amount of data, would it then be safe to use the following generation of $IV'$ for ICBC, so we can use an $n$-bit $IV$ again?

$$IV' = \operatorname{CBC}_k(0^n, IV \| 0^{(s - 1) \cdot n})$$

I think it is secure (other than that the amount of data that can be securely encrypted is diminished by the amount of data that is encrypted for $IV'$, but that's as good as negligible, I suppose).

Of course, we assume the normal CBC conditions regarding unpredictability for the $IV$ in the scheme.


1 Answer 1


I'm reading the question's suggestion as using $\text{IV'}_0=\text{ENC}_k(\text{IV})$ as the Initialisation Vector for stripe $0$ and for $0<i<s$ using $\text{IV'}_i=\text{ENC}_k(\text{IV'}_{i-1})$ as the IV for stripe $i$.

That's not (CPA) secure, because it allows distinguishing that the plaintext starts with zero blocks: in that case, the second ciphertext block of stripe $0$ will be the same as the first ciphertext block of stripe $1$.

Addition: I do not immediately see an attack¹ if we build the IVs as $\text{IV'}_0=\text{IV}$, $\text{IV'}_i=\text{ENC}_k(\text{IV'}_{i-1})\oplus\text{IV}$. Or this slightly different option, using the question's notation: $$\text{IV'} = \operatorname{CBC}_k(\text{IV},\text{IV}^s)$$

¹ which is not a conjecture of security.

  • $\begingroup$ Why not directly, $IV+i$ where $i$ is the stripe number. $\endgroup$
    – kelalaka
    Feb 12, 2020 at 20:25
  • $\begingroup$ @kelalaka: that allows a distinguisher too. For example, set the first data block of each stripe equal to the stripe number, and with fair probability the first ciphertext block of some stripes are equal. $\endgroup$
    – fgrieu
    Feb 12, 2020 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.