Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
278
questions
3
votes
1answer
251 views
AES-CBC streaming configuration IV usage
I am interested in the implications of using AES-CBC in a streaming configuration.
Reading the specifications of a few protocols I notice that when using AES-CBC
they include IV + ciphertext + HMAC ...
0
votes
1answer
44 views
It is the IV shared in CBC mode?
I don't know if the IV in CBC mode is equal in both sides of the encryption and decryption operations.
I know that the IV must be unpredictable, but has it to be MACed in the encryption side to be ...
0
votes
1answer
55 views
How does OPENSSL handle generation of unique IVs for AES-GCM
Generating unique IVs for AES GCM is elaborated in RFC-5288. However, I am unable to find an exact mapping of the explanation given in the RFC, with the OPENSSL C library. Could anyone help me with ...
0
votes
1answer
111 views
AES-GCM cipher - Nonce vs IV
I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers:
https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html
As you see, IV is not ...
1
vote
3answers
387 views
What happens if you increment MAX counter in AES-CTR?
Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
0
votes
1answer
61 views
Signal Protocol Header key encryption initialization vector
In Signal Protocol when you use a Double Ratchet you have 2 options:
Normal encryption = header + ciphertext
Encrypted header encryption = ...
3
votes
2answers
74 views
Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector?
I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature:
...
0
votes
2answers
97 views
IVs in WEP encryption
First, I'm pretty new to the world of encryption. As I understand it, in WEP, the plaintext and CRC are XOR'd with the IV and the key (or more accurately, the key/stream, which is produced by a pseudo-...
0
votes
0answers
75 views
Is it possible to recover the key to a decrypted file? [duplicate]
Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged in CBC mode? If so how?
The file I want to recover the key from is a xml that ...
8
votes
3answers
1k views
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
0
votes
0answers
43 views
What is the most secure way to encrypt certain properties in logs
I would like to encrypt certain data before logging it. Currently, I use a private key and a static IV.
Looking at generating a suitable IV I am concerned about the overhead in generating CSPRNG ...
0
votes
1answer
35 views
Randomly initialised global counter used to encrypt the kth message with IV = IV + k mod 2^n
The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then IV + 1 for the second , IV + 2 for the 3rd etc. How can I construct an attack to ...
2
votes
1answer
282 views
IPsec : transmission of Initialization Vector
I am currently carrying scholar research about IPsec protocol, and I have a question regarding the IP Encapsulating Security Payload (ESP). Is the initialization vector of operation mode transmitted ...
1
vote
1answer
72 views
IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)
I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode.
Assuming I have:
The ability to arbitrary encrypt known plaintexts
The IV
I know ...
0
votes
0answers
40 views
Maximum key stream sequence per key/IV pair in communication protocols
In the paper "LIZARD – A Lightweight Stream Cipher for Power-constrained Devices", one of the design rational of Lizard cipher is key stream size per key/iv pair.
A5/1 produces only 228 keystream ...
1
vote
1answer
81 views
AES-GCM cipher tag and IV size, while attempting to render encrypted ciphertext useless by removing them
I'm using AES in GCM mode of operation for encryption/decryption & authentication of segments of data in a file. The layout of each segment can be summerized by this diagram. Each segment is ...
0
votes
1answer
116 views
how to compute IV with AES CTR if key, plaintext and ciphertext are known?
Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
0
votes
2answers
96 views
Question about IV from CBC/AES-256
I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough.
In my case, I generated random AES key for each file to encrypt and decrypt them.
My ...
1
vote
1answer
135 views
Alter plaintext through IV in block cipher AES in CBC mode
IV: 69bb375aa919c72aa561dd7b7ffacf66
Ciphertext: "c28ea025d10186510855d083747d6435c808d9857075abd9bfc54b094e60eaf3"
Plaintext: "SEND ENCRYPTED DATA"
I want to be able to change the resulting ...
2
votes
2answers
827 views
AES256 GCM IV guidelines
If I use for example AES256 (GCM), and my message is bigger than 256bit (breaked into smaller 256bit blocks for encryption), should the IV change every 256bit of the message?
1
vote
1answer
89 views
AES-256-CBC with random IV - storing same plaintext as same ciphertext
I am encrypting some information stored in a column of a MySQL database.
The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:...
1
vote
2answers
69 views
Why can´t an attacker find the key if he has the plain text, the IV and the ciphertext? [duplicate]
I am reading a book about web security and they are now talking about AES CBC.
After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain ...
1
vote
1answer
66 views
With AES-GCM, may I use multiple tags per key?
In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
2
votes
2answers
101 views
Safely erasing encrypted data
My secret message is encrypted in a byte buffer with AES-128 in CBC mode. The first 16 bytes are the IV and the message follows contiguously. If I want to securely delete this message is it enough ...
2
votes
1answer
174 views
Is an IV useless for encrypting database IDs?
In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
4
votes
1answer
181 views
Crypto-shredding a file by erasing the IV instead of erasing the Key
Imagine an authenticated, encrypted file system, which uses AES-256-CTR to encrypt a 64 KB file sector, then uses HMAC-SHA256 to authenticate the 64 KB file sector (including the IV). IVs are 128-bit, ...
1
vote
1answer
208 views
Simulation of Chosen Plaintext Attack on CBC, Predictable IV with OpenSSL
I would like to simulate the CBC IV attack where the IV is predictable.
It's described in the answer to this question:
chosen plaintext attack on CBC, predictable iv
(Only "Yes" and "No" are valid ...
0
votes
1answer
130 views
Recovery of private key in AES-CBC from two ciphertexts with different IV, but identical plantext
I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages,...
1
vote
2answers
90 views
Encryption using deterministic CSPRNG as secure as CSPRNG
As a beginner it seems that a scheme derived from a CSPRNG should be as secure as that CSPRNG. Is this a correct assumption? Are there restrictions or known special cases? A rough outline would be:
...
2
votes
1answer
169 views
Does it matter how the IV and XOR are applied for a single AES-128 block?
I want to encrypt 128 bits of data. I understand the problem with ECB, so I generate a 128-bit Initialization Vector to use for encryption and send with the encrypted data. Is there a "best" way to ...
0
votes
2answers
209 views
Can I find the IV of a single block of SHA256, given the plaintext and digest?
Each 512-bit block of SHA256 takes an initialization vector (IV) and message schedule and returns a digest. Knowing the message schedule and resulting digest, is it feasible to reverse the algorithm ...
1
vote
1answer
669 views
Decrypting an encrypted aes 256 cbc text with random IV, decrypts the string [duplicate]
This may be a basic question but bear with me.
I started encrypting a text with aes 256 cbc mode generating a random iv of 16 bytes and a key.
...
1
vote
2answers
86 views
Encrypting current time using 3DES as a signature
I came across a peculiar system for generating "signatures" ("signatures" is within quotes because this is a bad use of 3DES) in the wild.
It works as follows: a symmetric key is generated and used ...
0
votes
1answer
72 views
1
vote
1answer
499 views
Does an IV need to be used in AES CTR mode?
If I encrypt a message once using AES CTR, will I need an IV? Additionally, if I do use an IV, will I need to send it with the cipher text?
4
votes
1answer
212 views
Is it ok to transmit an IV as a custom HTTP header?
Considering an AES OFB encryption algorithm, suppose that I'm sending a message over HTTP (not HTTPS) and my message body contains the cyphertext. I'd like to know if transmitting a random ...
1
vote
0answers
65 views
Help decrypting AES-256-CBC data with bad initialization vector of 0xC0FFEE
For a game I am trying to decrypt data that was originally encrypted using AES-256-CBC given a key and the following initialization vector: 0xC0FFEE
The initialization vector appears to be short, ...
0
votes
1answer
192 views
Is encrypting multiple message with same key and iv secure for this case? [duplicate]
AES256, CBC
IV is sha512 of key.
Ek[random padding | message | random padding]
How much information would be leaked from the use of the same IV & key in this way, assuming the adversary has ...
8
votes
2answers
428 views
Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?
NIST specified SHA-2 hash functions with truncated output. Those hashes use different initialization values than SHA-256 or SHA-512. SHA-224 is based on SHA-256. SHA-384, SHA-512/224 and SHA-512/256 ...
0
votes
1answer
76 views
Encryption / Decryption method secure
I was wondering whether this encryption / decryption flow is very solid / secure. I encrypt the data using AES CBC 256 bit with an static IV.
When the user logs in with his Firebase account (first ...
0
votes
2answers
204 views
TLS1.2 AES 128 CBC Encrypted Data size is not a multiple of block size [closed]
I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown https://tools.ietf.org/html/rfc5246#section-6.2.3.2. From my understanding the ciphertext MUST be a multiple of the ...
4
votes
1answer
265 views
Would it be safe to use the message hash as the IV in ChaCha?
This seemed like an option if the hash is unpredictable.
It could be the hash of the message or the hash of the message + some common secret (apart from the key).
The only circumstance in which the ...
0
votes
1answer
89 views
Sending the nonce in ChachaPoly1305 with the ciphertext
I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc.
Is it secure to send the nonce over ...
-1
votes
1answer
626 views
How can you change this message which is in block cipher AES-256 in CBC?
Given is the secret message encrypted with AES-256 in CBC mode
5a04ec902686fb05a6b7a338b6e07760 14c4e6965fc2ed2cd358754494aceffa
The first 16 Byte is the initial ...
4
votes
3answers
676 views
Reusing IV in AES for encrypting file
Everyone says that you shouldn't use the same IV and Key.
Is it safe to use the same IV and Key on only one file. EDIT: I will be using CBC or CFB encryption modes so the IV will be updated based on ...
3
votes
2answers
172 views
Generate $J_0$ for GCM cipher when $\operatorname{len}(IV) \neq 96$ bits
I have the following questions about the construction of J0 when is not equal to 96 bits, $s= 128\big\lceil \operatorname{len}(\text{IV})/128\big\rceil-\operatorname{len}(\text{IV})$
For example if ...
0
votes
2answers
68 views
Does selecting a set of random numbers for the key and IV insure security?
For AES 256 - if I use a random 32 byte sequence for the 256 bit key and another 16 byte for the 128 bit initialization vector, does this insure that my cipher text cannot be broken in any short ...
3
votes
1answer
456 views
Do aes_256_gcm IVs just need to be unique for that key?
I'm using GCM (via openssl's EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))).
The IV's default length is 12 bytes.
It says that the IV must be ...
-1
votes
4answers
317 views
IV vector is not random. Is it critical?
Reading the spec of one of the IoT protocols, I found that IV for it one isn't actually random, it consist of $n$ bytes that represents manufacter-specific string; the same for all devices plus 6 ...
4
votes
4answers
969 views
Text partially decrypted regardless of IV
I'm trying to work out which AES cipher is best to use. I'm working with the OpenSSL ruby gem.
While testing the various options I noticed that most of the ciphers result in partial or even full ...
