Linked Questions

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...

I have three questions related to the use of IV within CBC mode of operation: Why, exactly, is it so bad to have a fixed (or predictable) IV in CBC mode? An example would be great! Given 1., why is a ...

What are the best practices for IV generation for AES and other algorithms? Is RNG enough? What if I cannot use RNG and need to use a variable that is related to some characteristic of the ...

I understood the XOR trick that allows an attacker to guess a block of a previously sent message from the client to the server: the attacker forces the client to send the message $\tilde{m} = c_n \...

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...

Ahead of the question, little warning. Question is not about what are the better options. Question is why it is bad idea? Ok, suppose we have plaintext $p$, which divided into blocks: $p_1,p_2,p_3,......

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...

I would like to simulate the CBC IV attack where the IV is predictable. It's described in the answer to this question: chosen plaintext attack on CBC, predictable iv (Only "Yes" and "No" are valid ...

I found some code to get crypto-js to encrypt data in the browser, and with a pointer from someone on SO, it now decodes data as well. My next question is about the use of an IV; is an IV like a salt ...

We need to exchange some data encrypted between a device and our software where the device does not have access to a source of randomness. Both the software and the device know the key (although they ...

The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then IV + 1 for the second , IV + 2 for the 3rd etc. How can I construct an attack to ...

this forum is way above me and the members here are far, far smarter than I am, so this probaby isn't the place to ask such a simple question, but whatever. All I wanted to ask is for at rest ...

I have 2 questions regarding security issues related to initialization vectors used in AES CBC Consider that I'm using a sequence number (which increments with every encryption) as an initialization ...