Linked Questions

1
vote
0answers
87 views

AES CBC Initialization vector - Security issues [duplicate]

I have 2 questions regarding security issues related to initialization vectors used in AES CBC Consider that I'm using a sequence number (which increments with every encryption) as an initialization ...
75
votes
9answers
107k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
21
votes
2answers
31k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
10
votes
1answer
997 views

Which block cipher parameters should be kept secret?

Which of the parameters of a block cipher (e.g., algorithm name, mode of operation, IV (if any), key length) are essential to keep secret?
4
votes
1answer
5k views

CBC with a fixed or random IV

I have three questions related to the use of IV within CBC mode of operation: Why, exactly, is it so bad to have a fixed (or predictable) IV in CBC mode? An example would be great! Given 1., why is a ...
8
votes
2answers
883 views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
7
votes
1answer
265 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
2
votes
1answer
1k views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
3
votes
2answers
1k views

How to defend AES against chosen-plaintext attack?

I have a server which encrypts files with the same AES key. Users can upload a file and download its encrypted version. A user can upload as many files as he wants. Users can decrypt the documents via ...
1
vote
1answer
1k views

Question about IV/initialization vectors

I found some code to get crypto-js to encrypt data in the browser, and with a pointer from someone on SO, it now decodes data as well. My next question is about the use of an IV; is an IV like a salt ...
4
votes
1answer
670 views

Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
2
votes
1answer
557 views

Plaintext block chaining, bad idea why?

Ahead of the question, little warning. Question is not about what are the better options. Question is why it is bad idea? Ok, suppose we have plaintext $p$, which divided into blocks: $p_1,p_2,p_3,......
1
vote
1answer
316 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
2
votes
2answers
131 views

using different IV and SALT with AES-CBC but same KEY

I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC. Now, each time I encrypt something, ...
1
vote
1answer
434 views

Simulation of Chosen Plaintext Attack on CBC, Predictable IV with OpenSSL

I would like to simulate the CBC IV attack where the IV is predictable. It's described in the answer to this question: chosen plaintext attack on CBC, predictable iv (Only "Yes" and "No" are valid ...
2
votes
1answer
267 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
2
votes
2answers
175 views

Any advantage of multiple salts/keys for single password when using PBKDF for multiple secrets?

Background: I'm putting together a personal project to store multiple short message protected by a master password. This is more to learn and demonstrate that I understand how to use some standard ...
3
votes
2answers
90 views

Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector?

I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature: ...
0
votes
2answers
182 views

Is it required to use a random IV for AES-CBC with random key per message? [duplicate]

I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough. In my case, I generated random AES key for each file to encrypt and decrypt them. My ...
-4
votes
1answer
182 views

at rest encrypton question from someone who knows nothing

this forum is way above me and the members here are far, far smarter than I am, so this probaby isn't the place to ask such a simple question, but whatever. All I wanted to ask is for at rest ...
3
votes
1answer
161 views

BEAST Attack: from guessing to decoding

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
1
vote
1answer
77 views

Initialization vector based on data which can be changed by an attacker

We need to exchange some data encrypted between a device and our software where the device does not have access to a source of randomness. Both the software and the device know the key (although they ...
3
votes
1answer
96 views

Best practices for IV generation

What are the best practices for IV generation for AES and other algorithms? Is RNG enough? What if I cannot use RNG and need to use a variable that is related to some characteristic of the ...
0
votes
1answer
48 views

Randomly initialised global counter used to encrypt the kth message with IV = IV + k mod 2^n

The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then IV + 1 for the second , IV + 2 for the 3rd etc. How can I construct an attack to ...