1
$\begingroup$

The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following:

$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$

https://en.wikipedia.org/wiki/Disk_encryption_theory#Cipher-block_chaining_(CBC)

This is to ensure that the IV is unpredictable to an attacker.

I am wondering why not simply hash the key followed by the sector number and eliminate the extra computation required by the block encryption:

$$\text{IV} = \operatorname{Hash} (K \mathbin\| S)$$

Would not this be equally secure but more efficient?

$\endgroup$
4
$\begingroup$

Block cipher encryption $$\operatorname{Enc}(K,P): \{0,1\}^k \times \{0,1\}^n \rightarrow \{0,1\}^n$$

is a permutation where a $K \in \mathcal{K}$ select a permutation from all possible permutations of $\{0,1\}^n$. Using

$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$ will guarantee that the output is unique, not repeating, since the $\operatorname{Hash}(K)$ is fixed key for the operation. This will also guarantee that the output is 128-bit as a required IV size for CBC.

If you use

$$\text{IV} = \operatorname{Hash} (K \mathbin\| S)$$ then due to the collision property - birthday attack - of the hash functions some sector can have the same IV that is not wanted. One has to trim the output of the hash function to 128-bit so for a $2^{64}$ sector numbers we expect an IV collision with 50% probability. This probability is not negligible and one must stop way earlier.

For a 3TB disk, there are 5,859,375,000 sectors which make around 33 bits. The probability of collision is quite low for this, like $$1-e^{-\big(\frac{{(2^{33})}^2}{2\cdot 2^{128}} \big)} \approx 1.08\cdot 10^{-19}$$

by using the approximation formula for the Birthday attack

$$p(n;H) \approx 1 - e^{-n(n-1)/(2H)} \approx 1-e^{-n^2/(2H)}$$

But never zero!.

Conclusion: the first guarantees that there is no collision and therefore the first approach is preferable to the second approach.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.