Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
331
questions
0
votes
0answers
47 views
Comparing the security when using fixed IV for CBC and CTR
Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
0answers
49 views
Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)
I want to prove the security of a Tweakable Block Cipher in CBC Mode
How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
2
votes
0answers
35 views
LibTomCrypt Documentation on LRW Mode/Tweakable Block Cipher - Apparent Contradiction?
In the LRW mode discussion on page 34/161 of the LibTomCrypt manual, available here for example
https://opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/Source/libtomcrypt/doc/...
1
vote
1answer
93 views
Finding the IV of AES CBC (CTF)
We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we ...
0
votes
1answer
54 views
Is it safe to reuse an IV 100 times to a single key with AES CBC? [duplicate]
I have a unique 6 digit number that I am generating a IV from. I am trying to make it as unique as possible. From my programming, I am able to get it down to only have 100 duplicate IVs per unique 6 ...
0
votes
1answer
48 views
IV in RSA Encrypted Private Key
I have been provided an RSA encrypted private key which was generated in NodeJS (crypto) using the following:
...
1
vote
1answer
44 views
Where is the SIV in AES-GCM-SIV?
This is my understanding of Synthentic IVs
You have 2 keys $K_1$ & $K_2$.
$F$ is a PRF
Instead of choosing a separate IV, you instead generate the IV from the PlainText.
$IV = F(K_1, m)$
$c = E(...
1
vote
0answers
28 views
Is it necessary to use an IV in CBC mode when just encrypting one file? [duplicate]
As far as I know, CBC mode, even with a null IV, will encrypt identical plaintext blocks to unique ciphertext blocks within a single file. The purpose of an IV is to obscure the similarities between ...
0
votes
1answer
67 views
Deterministic Encryption - Generating IV from password key
I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption.
...
3
votes
1answer
172 views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
2answers
87 views
With AES-CTR does the block input need to be implemented as nonce || counter?
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
0
votes
1answer
65 views
What would be the most recommended AES && RSA Keys for production?
While I am a front-end developer and not a security expert programmer, I am worry about the keys I am using for my AES && RSA encryption. Please help me to understand:
Is the following keys ...
2
votes
1answer
87 views
Combining CTR and ECB modes to prevent attacks
In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
0
votes
1answer
47 views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
2
votes
1answer
332 views
Can you change an AES encrypted message if you control the IV?
Let's say that an attacker has the plaintext, the ciphertext and the IV of a specific message. If the attacker can control the ciphertext and the IV, could he forge valid plaintext? Let's say that the ...
1
vote
0answers
38 views
Changing a bit in IV of MD5
It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
5
votes
1answer
98 views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
1
vote
1answer
61 views
Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?
I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
0
votes
1answer
84 views
Why would you want to keep the Initialization Vectors Public?
So I was researching Initialization Vectors (IV) and even took a look at this thread... What is the main difference between a key, an IV and a nonce? ,but I was hoping that I could get some clarity.
...
0
votes
1answer
39 views
Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector
When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector?
Meaning if ...
1
vote
1answer
48 views
Number message limits of Galois/Counter Mode (GCM) per key
In
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
page 27,
it is said that
...the total number of blocks of plaintext and AAD that are protected by
invocations of the ...
7
votes
3answers
1k views
Why SHA-512/256 when we already have SHA-384?
Both of them are just SHA-512 with different IV's and truncation. What's the point of having 2 of them? (Actually we have 3 of them as SHA-512/224 is the exact same thing.)
3
votes
2answers
145 views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
10
votes
1answer
1k views
Why does SHA2-224 use different IV's than SHA2-256?
Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.
1
vote
2answers
53 views
Multiple IV CBC
CBC's encryption is not paralelizable but I could divide a 64 block message in 4 16 block parts and encrypt those 4 parts separatly in parallel using a diferent IV for each one. Is this unsecure ? Is ...
0
votes
2answers
284 views
Find IV and the key ? AES with CFB or OFB
I have a question about the AES-128 and AES-256 encryption method. I need to encrypt 64-bit size data in and out. I want to encrypt them with AES.
So I turned to AES-OFB or AES-CFB because these ...
2
votes
0answers
51 views
Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?
Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
1
vote
1answer
243 views
Encryption with Web Crypto API (SubtleCrypto)
I want to end-to-end encrypt items in a stateless environment. These items have an identifier (random string). Now I want to add encryption by adding a random key. The URL could be ...
1
vote
1answer
68 views
JOSE: JWE CEK Initialization Vector Position or Reuse
So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content.
My issue however is that NaCl needs an IV (nonce in NaCl) for ...
0
votes
1answer
52 views
AES-256 CTR with ESSIV, is this correct?
I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is:
...
3
votes
1answer
81 views
Number of keystreams generated in Kreyvium for a single key/IV pair
Kreyvium employs 128-bit key and 128-bit IV. By a single initialization procedure using a key/IV pair, how many keystreams can be generated?
1
vote
1answer
129 views
ECRYPT Salsa20 Test Vectors Interpretation
I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I ...
1
vote
1answer
129 views
Crypto system design : How to design Encryption for Zero width characters
Zero width character's can be used to hide text in plain sight.I am building a system where user's can provide their secret message , cover message and a password (key) which I would encrypt and give ...
1
vote
0answers
45 views
Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?
Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
5
votes
1answer
551 views
What is the significance of IV in stream ciphers like Trivium?
In Trivium cipher, an 80-bit key and 80-bit IV (initialization vector) are used initially to set up the initial state. I would like to know,
Role of IV in stream cipher?
Can we make IV a secret ...
1
vote
1answer
69 views
When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?
The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following:
$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$
https://en....
4
votes
1answer
92 views
If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?
The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
3
votes
2answers
271 views
Size of IV in AES-GCM according to RFC 4106
RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
2
votes
1answer
1k views
IV generation best practice for AES-256 CBC
I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure?
What is the best practice to generate IV for AES 256? Will ...
2
votes
1answer
195 views
Finding the IV values of SHA-256 given all message blocks
Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with ...
2
votes
1answer
38 views
Longer IV generation from a single block IV for ICBC
I was reading a question about ICBC here and it mentioned that you would need a $s \cdot n$-bit $IV$ if you would use $s$ "stripes", where $n$ is the blocksize.
Say that we don't like transmit that ...
2
votes
1answer
56 views
Reusing IV but still generating different code?
I'm in a beginner's cryptography class and I'm trying to figure out if I'm doing something wrong, or if I just don't understand why something is the way it is.
I created a simple .txt file of 124 ...
2
votes
3answers
2k views
Does the Initialization Vector in DES have to be 8 bytes long?
I was experimenting around with DES and decided to implement an IV (Initialization Vector) for it. I noticed that in DES, which is 56 bits and 8 parity bits, the IV would be 8 bytes in length. Does ...
3
votes
2answers
2k views
Given the key, the plain text and the cipher text can I calculate the IV used in CBC mode?
If I have the plain text, the ciphertext and the key for an AES-128 CBC operation, can I determine the IV, even if I don't know the padding (assuming the padding follows one of the more common formats)...
2
votes
1answer
40 views
Security implications of not concatenating a 1 to the IV when using GCM
When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
0
votes
2answers
529 views
How to generate a 128 bit IV from a 32 bit value for AES-128 OFB
I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value 0x9a23773c (...
1
vote
1answer
448 views
How does reusing IV for OFB mode breaks the scheme
Consider a Plaintext P1 and Ciphertext P2, which is known to the attacker. If the attacker knows that the IV used in encrypting P1 in OFB mode is the same used to encrypt another plaintext P2, how can ...
2
votes
2answers
712 views
using different IV and SALT with AES-CBC but same KEY
I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC.
Now, each time I encrypt something, ...
1
vote
1answer
55 views
Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?
Let || be the concatenation operator.
Let CipherText = AES(Key1, IV, Message).
Let us assume AES is used in CBC mode.
I want ...
2
votes
3answers
322 views
AES Cipher Block Chaining 128 bit message
I understand that for AES CBC you need to split the plaintext up into blocks and perform XOR'ing using the previous blocks calculations etc.
However, if your message is exactly 128 bits long, do you ...
