Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
351
questions
4
votes
1answer
135 views
Java: SecureRandom.getInstanceStrong() vs new SecureRandom()
Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
2
votes
2answers
384 views
Distinguishing the correct IV from incorrect IV in AES CBC when key is known
Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
1
vote
1answer
93 views
Is it okay to avoid a plaintext IV in AES?
The scenario
Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.)
The goal (explained more later)
To avoid sending an unencrypted IV.
But since this is being done using .NET ...
1
vote
1answer
67 views
Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?
When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption?
For easier ...
0
votes
1answer
68 views
Can a one time public key'd HMAC be secure?
Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be ...
1
vote
2answers
246 views
Why is possible to encrypt multiple messages within the same stream in AES
I have a standard random key and IV. Then I am creating a cipher using these keys and iv and then encrypt a specific message. Later on, if I try to encrypt another message with the same cipher(which ...
2
votes
1answer
35 views
Is the tag generated in MAC equal for equal messages in CBC-MAC?
The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
1
vote
1answer
54 views
Safety of AES-256/CBC/PKCS#7 + randomization and reusage of IV
As a start, I'm by any means no expert or anything near that in cryptography. I know the very basic about this, enough to more or less choose a method to implement and then read about it so I knew ...
0
votes
0answers
18 views
layout scheme to store encrypted files
I'm working on a little hobby project to better understand crypto.
https://app.gitbook.com/@noojee/s/dvault/
The aim is to make it easy to encrypt a set of files into a 'vault' and decrypt them at a ...
1
vote
1answer
50 views
HKDF with predefined IV
Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"?
My use-case is an app that ...
0
votes
0answers
47 views
CBC mode, fixed Key and IV but unique plaintexts
My transport channel is sufficiently tiny that I don't want to give up 16 bytes for an IV (AES block size). My environment is also resource constrained such that I have no RNG.
I have read over and ...
1
vote
1answer
38 views
How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?
I have a device that needs to communicate with another host and exchange fixed-length messages.
All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
1
vote
1answer
226 views
CTR overlap with random IV
Problem:
I'm slightly worried about counter repeats in CTR mode when using random IV.
If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
0
votes
1answer
213 views
How to use nonce, counter, and IV in AES-256-CTR?
preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.
how do i construct a valid IV, given a nonce? What does this have to do ...
1
vote
0answers
237 views
How can I decrypt AES-256 GCM with key with a IV that is missing?
I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
0
votes
0answers
43 views
Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
0
votes
1answer
71 views
Decrypting the same message with the same IV using aes-256-cbc
Is it safe to use the same IV when decrypting the exact same encrypted message. From my understanding, there is a security flaw when using the same IV for numerous different messages, as attackers can ...
2
votes
2answers
240 views
Secure AES IV with static salt
I have an (offline) shared secret key (symmetric) which is used to encrypt/decrypt data.
Now this data belongs to a specific user which is known on the backend and frontend. My idea was to use the ...
0
votes
0answers
48 views
Do I need an inititalization vector if I don't care about message leaking?
In Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector, an answer says
using a fixed IV is bad practice since it allows statistical ...
0
votes
0answers
36 views
How to allow a partner to encrypt a message that I can decrypt without using a random initialization vector?
My company has a requirement to allow a partner vendor to log people into our web app via some kind of single sign on. We need this to be a simple process for them, not involving the use of ...
0
votes
1answer
136 views
Comparing the security when using fixed IV for CBC and CTR
Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
0answers
69 views
Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)
I want to prove the security of a Tweakable Block Cipher in CBC Mode
How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
2
votes
0answers
42 views
LibTomCrypt Documentation on LRW Mode/Tweakable Block Cipher - Apparent Contradiction?
In the LRW mode discussion on page 34/161 of the LibTomCrypt manual, available here for example
https://opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/Source/libtomcrypt/doc/...
1
vote
1answer
815 views
Finding the IV of AES CBC (CTF)
We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we ...
1
vote
1answer
90 views
Is it safe to reuse an IV 100 times to a single key with AES CBC? [duplicate]
I have a unique 6 digit number that I am generating a IV from. I am trying to make it as unique as possible. From my programming, I am able to get it down to only have 100 duplicate IVs per unique 6 ...
0
votes
1answer
179 views
IV in RSA Encrypted Private Key
I have been provided an RSA encrypted private key which was generated in NodeJS (crypto) using the following:
...
1
vote
1answer
189 views
Where is the SIV in AES-GCM-SIV?
This is my understanding of Synthentic IVs
You have 2 keys $K_1$ & $K_2$.
$F$ is a PRF
Instead of choosing a separate IV, you instead generate the IV from the PlainText.
$IV = F(K_1, m)$
$c = E(...
1
vote
0answers
28 views
Is it necessary to use an IV in CBC mode when just encrypting one file? [duplicate]
As far as I know, CBC mode, even with a null IV, will encrypt identical plaintext blocks to unique ciphertext blocks within a single file. The purpose of an IV is to obscure the similarities between ...
0
votes
1answer
107 views
Deterministic Encryption - Generating IV from password key
I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption.
...
3
votes
1answer
411 views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
2answers
183 views
With AES-CTR does the block input need to be implemented as nonce || counter?
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
0
votes
1answer
88 views
What would be the most recommended AES && RSA Keys for production?
While I am a front-end developer and not a security expert programmer, I am worry about the keys I am using for my AES && RSA encryption. Please help me to understand:
Is the following keys ...
2
votes
1answer
127 views
Combining CTR and ECB modes to prevent attacks
In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
0
votes
1answer
89 views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
2
votes
1answer
879 views
Can you change an AES encrypted message if you control the IV?
Let's say that an attacker has the plaintext, the ciphertext and the IV of a specific message. If the attacker can control the ciphertext and the IV, could he forge valid plaintext? Let's say that the ...
1
vote
0answers
51 views
Changing a bit in IV of MD5
It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
5
votes
1answer
215 views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
1
vote
1answer
135 views
Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?
I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
0
votes
1answer
192 views
Why would you want to keep the Initialization Vectors Public?
So I was researching Initialization Vectors (IV) and even took a look at this thread... What is the main difference between a key, an IV and a nonce? ,but I was hoping that I could get some clarity.
...
1
vote
1answer
48 views
Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector
When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector?
Meaning if ...
1
vote
1answer
76 views
Number message limits of Galois/Counter Mode (GCM) per key
In
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
page 27,
it is said that
...the total number of blocks of plaintext and AAD that are protected by
invocations of the ...
7
votes
2answers
2k views
Why SHA-512/256 when we already have SHA-384?
Both of them are just SHA-512 with different IV's and truncation. What's the point of having 2 of them? (Actually we have 3 of them as SHA-512/224 is the exact same thing.)
3
votes
2answers
212 views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
12
votes
1answer
1k views
Why does SHA2-224 use different IV's than SHA2-256?
Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.
1
vote
2answers
63 views
Multiple IV CBC
CBC's encryption is not paralelizable but I could divide a 64 block message in 4 16 block parts and encrypt those 4 parts separatly in parallel using a diferent IV for each one. Is this unsecure ? Is ...
0
votes
2answers
559 views
Find IV and the key ? AES with CFB or OFB
I have a question about the AES-128 and AES-256 encryption method. I need to encrypt 64-bit size data in and out. I want to encrypt them with AES.
So I turned to AES-OFB or AES-CFB because these ...
2
votes
0answers
63 views
Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?
Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
1
vote
1answer
420 views
Encryption with Web Crypto API (SubtleCrypto)
I want to end-to-end encrypt items in a stateless environment. These items have an identifier (random string). Now I want to add encryption by adding a random key. The URL could be ...
1
vote
1answer
100 views
JOSE: JWE CEK Initialization Vector Position or Reuse
So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content.
My issue however is that NaCl needs an IV (nonce in NaCl) for ...
0
votes
1answer
87 views
AES-256 CTR with ESSIV, is this correct?
I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is:
...
