Do all forms of symmetric encryption require multiple pieces of information? (nonce, iv, etc)

Question

I'm attempting to learn encryption and have a very basic grasp of it, but I have questions.

First, I'm looking to use AES.

I want to take text, encrypt it with AES using a variable-length key, and return encrypted text. Then I'd like to pass in the encrypted text, the key, and get the original text back. In other words: a Symmetric cipher.

It seems every AES mode that I can see requires a piece of data for decryption that seems problematic to store. For instance, EAX has a nonce that needs stored. CFB has an Initialization Vector (iv) that needs stored.

The way I see it is that I can store the iv in a second location from the encrypted text or I can generate the iv predictably every single time.

Is it considered secure to store the iv or nonce?

Answer 1

The way I see it is that I can store the iv in a second location from the encrypted text or I can generate the iv predictably every single time.

Actually, if you don't mind the ciphertext being longer than the plaintext, we can just include the IV/nonce in with the ciphertext. What we typically do is place the IV/nonce at the front of the ciphertext, and place the output of the block mode right behind it. This means that the ciphertext is 8 to 16 bytes longer; for most use cases, we can live with that. We generally also want to store some sort of integrity tag as well (so that if someone modifies the data, we can detect it); that extends the ciphertext a bit more.

Of course, there are some use cases where the ciphertext must be exactly as long as the original plaintext (for example, if we're storing the encrypted data somewhere that was originally intended to store the plaintext, and so the space available to store data is limited to the expected size of the plaintext; this comes up both with encrypted databases and encrypted disk drives). We could, in this case, store the IV/nonce (and the integrity tag) elsewhere, however (in my experience) that's rather rare.

There are specialized modes that are designed to work with the constraint that the ciphertext is exactly the same length as the plaintext, such as XTS (generally used for disk sector encryption) and Format Preserving Encryption modes (designed for encoding small pieces of data, such as a credit card number); unless you require something that needs to live with this constraint, this is typically not the correct solution.

I can generate the iv predictably every single time.

Modes that use IV/nonce are typically badly behaved if you encrypt two plaintexts with the same IV/nonce; with EAX mode, you allow the adversary to deduce the XOR of the two plaintexts; with CFB mode, you allow the adversary to deduce how many blocks the plaintexts agree and on the block they first disagree, the XOR of those two blocks. Hence, generating the IV predictably every single time is generally not the correct solution.