Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
357
questions
1
vote
1
answer
78
views
Is it safe to "compress" an IV in AES256-CTR? [closed]
Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
- 217
0
votes
0
answers
42
views
Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret
I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
- 523
1
vote
0
answers
38
views
What would be the consequences of using a IV smaller than the block size in CBC encryption?
Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
- 523
2
votes
2
answers
82
views
What can an attacker do with this in-secure usage of AES-CFB8?
I believe I have found insecure usage of AES-CFB8 in an application I am working on and would hope someone could explain how and why this is insecure and what an attacker could do such as key recovery ...
- 23
1
vote
1
answer
50
views
AES-128-CFB repeated IV and KPA
I'm doing reverse-engineering a product and identified a critical issue with it. The work is done and the developer was notified, but for my own personal curiosity, I'd like to learn how to exploit it ...
2
votes
2
answers
316
views
Does keeping IV secret increase security of CTR mode?
Let's suppose I encrypt something with CTR mode and keep the key and IV secret.
Does keeping the IV secret together with the key increase strength of encryption?
- 523
4
votes
1
answer
217
views
Java: SecureRandom.getInstanceStrong() vs new SecureRandom()
Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
- 461
2
votes
2
answers
447
views
Distinguishing the correct IV from incorrect IV in AES CBC when key is known
Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
1
vote
1
answer
116
views
Is it okay to avoid a plaintext IV in AES?
The scenario
Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.)
The goal (explained more later)
To avoid sending an unencrypted IV.
But since this is being done using .NET ...
- 1,893
1
vote
1
answer
85
views
Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?
When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption?
For easier ...
- 143
0
votes
1
answer
74
views
Can a one time public key'd HMAC be secure?
Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be ...
- 13.9k
1
vote
2
answers
274
views
Why is possible to encrypt multiple messages within the same stream in AES
I have a standard random key and IV. Then I am creating a cipher using these keys and iv and then encrypt a specific message. Later on, if I try to encrypt another message with the same cipher(which ...
user96631
2
votes
1
answer
49
views
Is the tag generated in MAC equal for equal messages in CBC-MAC?
The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
- 69
1
vote
1
answer
100
views
Safety of AES-256/CBC/PKCS#7 + randomization and reusage of IV
As a start, I'm by any means no expert or anything near that in cryptography. I know the very basic about this, enough to more or less choose a method to implement and then read about it so I knew ...
- 113
0
votes
0
answers
18
views
layout scheme to store encrypted files
I'm working on a little hobby project to better understand crypto.
https://app.gitbook.com/@noojee/s/dvault/
The aim is to make it easy to encrypt a set of files into a 'vault' and decrypt them at a ...
- 101
1
vote
1
answer
75
views
HKDF with predefined IV
Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"?
My use-case is an app that ...
- 13
0
votes
0
answers
55
views
CBC mode, fixed Key and IV but unique plaintexts
My transport channel is sufficiently tiny that I don't want to give up 16 bytes for an IV (AES block size). My environment is also resource constrained such that I have no RNG.
I have read over and ...
- 21
1
vote
1
answer
45
views
How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?
I have a device that needs to communicate with another host and exchange fixed-length messages.
All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
- 111
2
votes
1
answer
254
views
CTR overlap with random IV
Problem:
I'm slightly worried about counter repeats in CTR mode when using random IV.
If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
- 1,322
1
vote
1
answer
447
views
How to use nonce, counter, and IV in AES-256-CTR?
preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.
how do i construct a valid IV, given a nonce? What does this have to do ...
- 11
1
vote
0
answers
328
views
How can I decrypt AES-256 GCM with key with a IV that is missing?
I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
- 11
0
votes
0
answers
48
views
Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
- 1
0
votes
1
answer
149
views
Decrypting the same message with the same IV using aes-256-cbc
Is it safe to use the same IV when decrypting the exact same encrypted message. From my understanding, there is a security flaw when using the same IV for numerous different messages, as attackers can ...
- 3
2
votes
2
answers
370
views
Secure AES IV with static salt
I have an (offline) shared secret key (symmetric) which is used to encrypt/decrypt data.
Now this data belongs to a specific user which is known on the backend and frontend. My idea was to use the ...
- 23
0
votes
0
answers
51
views
Do I need an inititalization vector if I don't care about message leaking?
In Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector, an answer says
using a fixed IV is bad practice since it allows statistical ...
- 123
0
votes
0
answers
36
views
How to allow a partner to encrypt a message that I can decrypt without using a random initialization vector?
My company has a requirement to allow a partner vendor to log people into our web app via some kind of single sign on. We need this to be a simple process for them, not involving the use of ...
- 123
0
votes
1
answer
251
views
Comparing the security when using fixed IV for CBC and CTR
Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
0
answers
94
views
Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)
I want to prove the security of a Tweakable Block Cipher in CBC Mode
How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
- 31
2
votes
0
answers
46
views
LibTomCrypt Documentation on LRW Mode/Tweakable Block Cipher - Apparent Contradiction?
In the LRW mode discussion on page 34/161 of the LibTomCrypt manual, available here for example
https://opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/Source/libtomcrypt/doc/...
- 31
1
vote
1
answer
1k
views
Finding the IV of AES CBC (CTF)
We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we ...
- 17
1
vote
1
answer
111
views
Is it safe to reuse an IV 100 times to a single key with AES CBC? [duplicate]
I have a unique 6 digit number that I am generating a IV from. I am trying to make it as unique as possible. From my programming, I am able to get it down to only have 100 duplicate IVs per unique 6 ...
- 13
0
votes
1
answer
271
views
IV in RSA Encrypted Private Key
I have been provided an RSA encrypted private key which was generated in NodeJS (crypto) using the following:
...
- 103
1
vote
1
answer
294
views
Where is the SIV in AES-GCM-SIV?
This is my understanding of Synthentic IVs
You have 2 keys $K_1$ & $K_2$.
$F$ is a PRF
Instead of choosing a separate IV, you instead generate the IV from the PlainText.
$IV = F(K_1, m)$
$c = E(...
- 1,637
1
vote
0
answers
28
views
Is it necessary to use an IV in CBC mode when just encrypting one file? [duplicate]
As far as I know, CBC mode, even with a null IV, will encrypt identical plaintext blocks to unique ciphertext blocks within a single file. The purpose of an IV is to obscure the similarities between ...
- 11
0
votes
1
answer
138
views
Deterministic Encryption - Generating IV from password key
I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption.
...
- 1
3
votes
1
answer
571
views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
- 155
2
votes
2
answers
217
views
With AES-CTR does the block input need to be implemented as nonce || counter?
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
- 179
0
votes
1
answer
95
views
What would be the most recommended AES && RSA Keys for production?
While I am a front-end developer and not a security expert programmer, I am worry about the keys I am using for my AES && RSA encryption. Please help me to understand:
Is the following keys ...
- 101
3
votes
1
answer
140
views
Combining CTR and ECB modes to prevent attacks
In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
- 229
1
vote
1
answer
107
views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
- 55
2
votes
1
answer
1k
views
Can you change an AES encrypted message if you control the IV?
Let's say that an attacker has the plaintext, the ciphertext and the IV of a specific message. If the attacker can control the ciphertext and the IV, could he forge valid plaintext? Let's say that the ...
- 21
1
vote
0
answers
65
views
Changing a bit in IV of MD5
It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
- 93
5
votes
1
answer
280
views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
- 43.4k
1
vote
1
answer
172
views
Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?
I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
0
votes
1
answer
234
views
Why would you want to keep the Initialization Vectors Public?
So I was researching Initialization Vectors (IV) and even took a look at this thread... What is the main difference between a key, an IV and a nonce? ,but I was hoping that I could get some clarity.
...
1
vote
1
answer
51
views
Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector
When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector?
Meaning if ...
- 159
1
vote
1
answer
99
views
Number message limits of Galois/Counter Mode (GCM) per key
In
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
page 27,
it is said that
...the total number of blocks of plaintext and AAD that are protected by
invocations of the ...
- 73
7
votes
2
answers
2k
views
Why SHA-512/256 when we already have SHA-384?
Both of them are just SHA-512 with different IV's and truncation. What's the point of having 2 of them? (Actually we have 3 of them as SHA-512/224 is the exact same thing.)
- 477
3
votes
2
answers
247
views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
- 1,105
12
votes
1
answer
1k
views
Why does SHA2-224 use different IV's than SHA2-256?
Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.
- 477