Linked Questions
26 questions linked to/from Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
10
votes
1answer
1k views
Which block cipher parameters should be kept secret?
Which of the parameters of a block cipher (e.g., algorithm name, mode of operation, IV (if any), key length) are essential to keep secret?
7
votes
1answer
285 views
Predictable, but private IV in CBC
It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
5
votes
1answer
7k views
CBC with a fixed or random IV
I have three questions related to the use of IV within CBC mode of operation:
Why, exactly, is it so bad to have a fixed (or predictable) IV in CBC mode? An example would be great!
Given 1., why is a ...
4
votes
1answer
753 views
Fixed-prefix IV in CBC mode
I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV?
I have multiple devices with poor entropy sharing the same key and I want to ...
3
votes
1answer
205 views
Best practices for IV generation
What are the best practices for IV generation for AES and other algorithms?
Is RNG enough?
What if I cannot use RNG and need to use a variable that is related to some characteristic of the ...
3
votes
1answer
179 views
BEAST Attack: from guessing to decoding
I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...
2
votes
1answer
297 views
Attack on AES-CBC with small pool of IV
Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$.
I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
2
votes
1answer
715 views
Plaintext block chaining, bad idea why?
Ahead of the question, little warning. Question is not about what are the better options. Question is why it is bad idea?
Ok, suppose we have plaintext $p$, which divided into blocks: $p_1,p_2,p_3,......
2
votes
1answer
1k views
Is it safe to AES-CBC and AES-CMAC both using the same key?
There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not).
I have a situation where I need to transfer some data. My data has ...
1
vote
1answer
741 views
Is it safe to send IV in plain text for every request?
Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
1
vote
1answer
1k views
Simulation of Chosen Plaintext Attack on CBC, Predictable IV with OpenSSL
I would like to simulate the CBC IV attack where the IV is predictable.
It's described in the answer to this question:
chosen plaintext attack on CBC, predictable iv
(Only "Yes" and "No" are valid ...
1
vote
1answer
1k views
Question about IV/initialization vectors
I found some code to get crypto-js to encrypt data in the browser, and with a pointer from someone on SO, it now decodes data as well.
My next question is about the use of an IV; is an IV like a salt ...
1
vote
1answer
103 views
Initialization vector based on data which can be changed by an attacker
We need to exchange some data encrypted between a device and our software where the device does not have access to a source of randomness. Both the software and the device know the key (although they ...
-5
votes
1answer
207 views
at rest encrypton question from someone who knows nothing
this forum is way above me and the members here are far, far smarter than I am, so this probaby isn't the place to ask such a simple question, but whatever.
All I wanted to ask is for at rest ...
1
vote
0answers
96 views
AES CBC Initialization vector - Security issues [duplicate]
I have 2 questions regarding security issues related to initialization vectors used in AES CBC
Consider that I'm using a sequence number (which increments with every encryption) as an initialization ...