# When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?

The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following:

$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$

https://en.wikipedia.org/wiki/Disk_encryption_theory#Cipher-block_chaining_(CBC)

This is to ensure that the IV is unpredictable to an attacker.

I am wondering why not simply hash the key followed by the sector number and eliminate the extra computation required by the block encryption:

$$\text{IV} = \operatorname{Hash} (K \mathbin\| S)$$

Would not this be equally secure but more efficient?

Block cipher encryption $$\operatorname{Enc}(K,P): \{0,1\}^k \times \{0,1\}^n \rightarrow \{0,1\}^n$$

is a permutation where a $$K \in \mathcal{K}$$ select a permutation from all possible permutations of $$\{0,1\}^n$$. Using

$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$ will guarantee that the output is unique, not repeating, since the $$\operatorname{Hash}(K)$$ is fixed key for the operation. This will also guarantee that the output is 128-bit as a required IV size for CBC.

If you use

$$\text{IV} = \operatorname{Hash} (K \mathbin\| S)$$ then due to the collision property - birthday attack - of the hash functions some sector can have the same IV that is not wanted. One has to trim the output of the hash function to 128-bit so for a $$2^{64}$$ sector numbers we expect an IV collision with 50% probability. This probability is not negligible and one must stop way earlier.

For a 3TB disk, there are 5,859,375,000 sectors which make around 33 bits. The probability of collision is quite low for this, like $$1-e^{-\big(\frac{{(2^{33})}^2}{2\cdot 2^{128}} \big)} \approx 1.08\cdot 10^{-19}$$

by using the approximation formula for the Birthday attack

$$p(n;H) \approx 1 - e^{-n(n-1)/(2H)} \approx 1-e^{-n^2/(2H)}$$

But never zero!.

Conclusion: the first guarantees that there is no collision and therefore the first approach is preferable to the second approach.