I am a bit confused about the use of IV, and key hash.

Is the key hash and IV stored inside the headers of the cipher text?

Isn't it a security risk to store this header information?

By key hash I mean the hash of key is stored inside the headers. It seems that when I use gpg or OpenSSL , the header of cipher text has encoded method and Iv and hash of key (if I am using a pass phrase )

  • $\begingroup$ If by key hash you mean the actual key, then no, of course it can't be transmitted and/or stored with the ciphertext. If that's not what you mean then please clarify. The IV, however, can be stored/transmitted with the ciphertext, as it's not required to be secret. You might find a few minutes on wikipedia enlightening. $\endgroup$
    – hunter
    Jul 11, 2013 at 11:36
  • $\begingroup$ @hunter I am confident he means the hash of a (cryptographically secure) key, which can be securely disclosed, though it could be clarified. $\endgroup$
    – Thomas
    Jul 12, 2013 at 10:58
  • $\begingroup$ @Thomas if that's the case, then sure, although I don't think it's good practise. The only reason I can think of to store the hash of a key with ciphertext would be to verify a correct key at decryption time. However, if the encryption is authenticated (which it should be) either by a dedicated AEAD mode, or with a MAC, then a hash of the key seems redundant. Does storing a hash of the key with ciphertext serve some other purpose? $\endgroup$
    – hunter
    Jul 12, 2013 at 13:11
  • $\begingroup$ @hunter It lets you verify you have the correct key before attempting to process a (potentially large) ciphertext message. There is also a MAC or an AEAD tag, of course, but it cannot be verified until the whole file has been acknowledged. This makes no sense in an interactive protocol, but for encryption at rest it is perfectly standard practice (though typically in those situations the key is derived from a password, so you also need a KDF + salt). $\endgroup$
    – Thomas
    Jul 13, 2013 at 3:11
  • 1
    $\begingroup$ You are correct that it is theoretically redundant, but sometimes you need to know if the key is the right one before proceeding to decrypt and authenticate perhaps gigabytes of data, possibly overwriting the existing ciphertext in the process. $\endgroup$
    – Thomas
    Jul 13, 2013 at 3:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.