From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this diagram to depict my understanding about TLS 1.0:

TLS 1.0

In the diagram above, the red arrow opens up TLS 1.0 to the BEAST attack. As of TLS 1.1, this seems to be fixed by creating explicit IVs:

[CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC residue of the previous record as the IV and therefore enabled this attack. This version uses an explicit IV in order to protect against this attack.

- RFC 4346

My question is: When and where exactly are these explicit IVs created? Are they created for each message like so (both messages are still being sent within the same stream like above)?:

Is this how CBC works in TLS 1.1?

Or do we now have explicit IVs for each record?:

enter image description here

... or is it neither of these?

I'm relatively unexperienced with all this so please forgive me if this is a silly question.


You might be somewhat confused by the term 'record'.

In TLS, a data to be encrypted is divided into a series of fragments; each fragment is encrypted as a record, with each record being encrypted and integrity protected independently [1]. Such a record can hold up to 16kbytes of data. This 'record' is standard TLS terminology and is what you are referring to as a 'message'. If you use a block cipher, then the amount of data that is processed by that block cipher at a time is referred to as a 'block' (not a 'record'), and in TLS, we generally don't talk about it that much, as there is generally little need to deal with the lower levels of how the crypto is done.

In TLS, each record is encrypted separately. If you use TLS 1.1 and CBC mode, when you encrypt a record, you pick an unpredictable IV, and then use that IV to CBC-mode encrypt all the data (and the HMAC of the data). You use CBC-mode in the standard way, and so CBC mode uses the IV the encrypt the first block (16 bytes for AES), and then uses resulting initial 16 bytes of ciphertext to encrypt the second block, and so on. It's just like TLS 1.0 CBC mode, except instead of using the previous ciphertext as the next IV, you use the value that appears immediately before the ciphertext. Hence, your first diagram is more accurate.

[1]: In addition, TLS sometimes sends messages between the encryptor and decryptor, to do the original negotiation, or to do rekeys. This data is also sent within records.

  • $\begingroup$ thank you for your answer poncho :). Could you just clarify to me this part "you use the value that appears immediately before the ciphertext". What would the value that appears immediately before the ciphertext be? $\endgroup$
    – Shnick
    Apr 26 '20 at 2:57
  • $\begingroup$ @Shnick: in a TLS 1.1 CBC-mode record, the IV is placed immediately in front of the ciphertext. $\endgroup$
    – poncho
    Apr 26 '20 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.