Linked Questions

11 votes
2 answers
6k views

Need for salt with IV

I have mainly referred to this question. Definitely in case of using a salt, IV has a use of adding randomisation to each and every key. But isn't it redundant in case of using an IV to use a salt? (...
Kaustubh's user avatar
  • 195
11 votes
1 answer
11k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
Jeremy's user avatar
  • 1
9 votes
1 answer
9k views

Why, or when, to use an Initialization Vector?

i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
Ian Boyd's user avatar
  • 1,001
5 votes
1 answer
1k views

AES CBC with unique key per message, but fixed IV

I'm working on a project with a scheme in which c[i] = AES-CBC-Encrypt(msg_key[i], IV, msg[i]), and two distinct plaintexts never have identical keys. ...
Jonas's user avatar
  • 779
4 votes
2 answers
1k views

Is it safe to use a constant IV for one-off symmetric file encryption?

My question is (hopefully, for somebody) a simple one; but my project is holding as I'm not sure. I read on SO that generating encryption keys without an IV is a bad idea, so is using a constant IV ...
Jonny Wilson's user avatar
4 votes
2 answers
2k views

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ...
windfly2006's user avatar
4 votes
1 answer
623 views

Convergent Encryption: integrity and authenticity

I have one question about convergent encryption. Suppose I use AES-256 in CBC mode. I need a 256 bits key and a 128 bits IV. If I use SHA-256 to hash one file, then I can use directly that hash as ...
Kingland's user avatar
2 votes
1 answer
403 views

Counter Mode: how to choose the nonce part of the counter? [duplicate]

Suppose: The "counter field" is about: NONCE || CTR-VALUE. I have multiples messages $M_a, M_b, M_c, \dots$ Each message can be divided into x-bits blocks ($M_{a1}, M_{a2}, M_{a3}, \dots$). Each ...
Kingland's user avatar
2 votes
0 answers
89 views

Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?

Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
jschw's user avatar
  • 121
1 vote
0 answers
29 views

Is it necessary to use an IV in CBC mode when just encrypting one file? [duplicate]

As far as I know, CBC mode, even with a null IV, will encrypt identical plaintext blocks to unique ciphertext blocks within a single file. The purpose of an IV is to obscure the similarities between ...
seadeef's user avatar
  • 11
1 vote
0 answers
31 views

If you use an AES key just once, do you need to use IV, and/or pad the message? [duplicate]

I am developing an application that is going to use AES encryption. Since it is going to use a different key for every message encrypted... Would it be secure to use a constant IV? (i.e null bytes) ...
Nathan Parker's user avatar
0 votes
1 answer
94 views

Is a static IV really less secure than an IV generated from a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication. ...
Neil Yoga Crypto's user avatar
0 votes
1 answer
201 views

Bundling hash into the initialization vector?

Given the need to transmit relatively short messages (a few dozens of bytes max), how unsecure would the following bundling of a hash in the initialization vector be? (A) = 64 bits of cryptographic ...
Eric Grange's user avatar
0 votes
2 answers
4k views

Is it required to use a random IV for AES-CBC with random key per message? [duplicate]

I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough. In my case, I generated random AES key for each file to encrypt and decrypt them. My ...
Adri's user avatar
  • 1