Let's suppose I encrypt something with CTR mode and keep the key and IV secret.
Does keeping the IV secret together with the key increase strength of encryption?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
1
Does keeping the IV secret together with the key increase strength of encryption?
Very little. In particular, under a known plaintext brute-force attack, it only strengthens the key by at most about 1 bit.
Argument: given two consecutive ciphertext blocks $C_0$, $C_1$ and their matching plaintext $P_0$, $P_1$, we can rule out key $K$ if $E_K(D_K(C_0\oplus P_0)+1)\ne C_1\oplus P_1$ (where the addition is modulo $2^b$ with $b$ the block size). Block decryption $D$ is about as costly as block encryption $E$, these two operations dominate the cost, which is thus about doubled compared to a brute-force attack with known IV.
A good reason not to keep the IV secret is that it needs to be known to the receiver, thus we'd need to encrypt it, making things more complicated and harder to analyze.
-
1$\begingroup$ Actually, in some cases, the strength addition is less than one bit. If the attacker knows some of the bits of the counter (e.g. for each message, you start the counter with the lower 32 bits as 0 for the first block), then the attacker can do a test of the intermediate value $D_k(C_0 \oplus P_0)$; that test will eliminate most of the wrong keys; the rest of the test will be run only a small fraction of the time. $\endgroup$– ponchoJan 28, 2022 at 15:36
$\begingroup$
$\endgroup$
The only secret is the key. CTR mode has Ind-CPA security, nothing you can gain more (Ind-CCAx,...) without integrity and authentication.
If you are setting your security on the secrecy of the IV, you are on the wrong path. Just make sure that the $(key,IV)$-pair is not repeated and read more on this post.
And, with your approach, you need an additional process to transmit the IV per message;
- You are somehow encrypting it, or
- You use DHKE and derive key and IV from the key exchange with a KDF.
The former is problematic, the latter can increase the communication cost ( a new DHKE per encryption for new IV or Key altogether).
Do not complicate the processes, just stick to the standards that exist for many years designed and analyzed by serious cryptographers.