Questions tagged [initialization-vector]

Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.

Filter by
Sorted by
Tagged with
0 votes
0 answers
71 views

Rate the security of the following MAC

Ok we know when we add a random IV in our encrypted MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks. But the addition at the ...
Poseid0n's user avatar
0 votes
1 answer
78 views

CBC KEY recovery when KEY=IV

We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server? ...
Sahar's user avatar
  • 3
0 votes
0 answers
126 views

CBC Predictable IV Help

I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
drift's user avatar
  • 1
0 votes
0 answers
30 views

How IV value shapes the State Matrix of PHOTON AEAD?

In PHOTON-Beetle Authenticated Encryption algorithm, the state consists of 64 4-bit elements, which is represented as a (8 × 8) matrix. The Initial Value which consists of Key and Nonce from the ...
Mohammadsadeq Borjiyan's user avatar
3 votes
1 answer
58 views

how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
eitan's user avatar
  • 31
1 vote
1 answer
65 views

Newbie question about AES-GCM and IV

Imagine a channel where the initial secret for deriving of the actual key is established with ECDH. First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
Kote Isaev's user avatar
2 votes
2 answers
103 views

Recommended way to generate a key and IV for CFB mode?

I need to generate a key and IV that will be used to encrypt multiple things over a period of time with AES in CFB mode. The decision to use AES in CFB mode is not mine to change and the key will only ...
Jonathan Wilson's user avatar
0 votes
0 answers
573 views

AES CBC - Find IV (CTF)

I am currently trying to solve a training challenge based on AES with CBC. This is the infos I'm given: ...
Shark44's user avatar
  • 145
1 vote
1 answer
59 views

Secure encryption in the presence of a keyservice

Imagine this scenario: On a particular PC is a service that provides cryptographic functions -- in particular AES-CBC and ECC (ECIES/ECDSA). The service provides access to a single key stored in an ...
Miral's user avatar
  • 113
2 votes
1 answer
110 views

AES encryption IV that won't need to be stored

I'm trying to implement an IV that won't need to be stored on it's own. I'm considering 3 options: Since I'm using PBKDF to generate a key I could use some bytes from the generated hash I could use ...
snow's user avatar
  • 23
1 vote
1 answer
38 views

Using Self-Generated Random Bits Instead of the Initialization Vector (IV)

I think my understanding on initialization vector (IV) might be lacking, but as I understand it, an IV is used to create randomness to an encrypted message so that the message is difficult to crack ...
Jarron's user avatar
  • 113
1 vote
2 answers
140 views

Role of IV in Perl's Crypt::Rijndael

Sorry in advance if I'm asking a stupid question: I thought the role of "IV" in encryption is to avoid having identical ciphertext for identical plaintext. So one could use some random IV. ...
U. Windl's user avatar
  • 163
0 votes
1 answer
65 views

Use name as the initialization vector to encrypt passwords for users

I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
troubleddev's user avatar
3 votes
1 answer
87 views

GCM-SIV vs CBC with fixed IV?

I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
Paul's user avatar
  • 31
2 votes
1 answer
365 views

Vulnerability due to same IV, same key, same plaintext at same position in OFB

I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the ...
Mango's user avatar
  • 23
1 vote
1 answer
37 views

Can the IV be reused if the key is changed?

I am using AES-GCM-256 to encrypt data in a database, and am using a single key that I salt with a unique random value for each user to encrypt their information. I am using the same IV for all of ...
Darcy Sutton's user avatar
1 vote
1 answer
299 views

XChaCha20-Poly1305 question about IV's

I've a question about XChaCha20-Poly1305, from a brute force perspective. Suppose we have the power to brute force crack it. If the IV is known to the attacker and it's only one file. The time needed ...
Andrew's user avatar
  • 13
0 votes
1 answer
158 views

How many bits of encryption are enforced in WEP (wired equivalent protocol)

I'm currently taking a computer security module in University and as part of a problem have been asked: My thought for the question is that no it does not provide 64 bits of security strength. This ...
hasin's user avatar
  • 77
6 votes
2 answers
1k views

Always set the IV to 0 randomized CBC

Please explain what goes wrong if we always set the IV to 0 in randomized CBC, and use the system to encrypt two different messages m0 /= m1 with the same key k. I ...
Amirhossein's user avatar
2 votes
2 answers
106 views

Generating an IV from a constant seed and predictable salt larger than the value space of the IV

I am planning to encrypt multiple values using a 16 byte IV that I'm generating from the below scheme. My seed is a 32 byte ...
Guiomar Raissa's user avatar
1 vote
0 answers
24 views

Encrypting an IV with XEX using a block cipher and XORing on the plaintext: Is this scheme valid?

I had an idea to make XEX mode parallelizable at CPU level. Let's suppose I take an IV, XOR with random data, encrypt, XOR again with another data, and XOR on the plaintext Would this encipherment ...
phantomcraft's user avatar
1 vote
1 answer
60 views

Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?

A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
phantomcraft's user avatar
1 vote
1 answer
388 views

How are long IVs used in AES-GCM?

I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
polfosol's user avatar
  • 201
2 votes
1 answer
152 views

what is IV predictable?

What is IV predictable in the CBC mode? We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
Mike Wallis's user avatar
0 votes
0 answers
123 views

How to encrypt keys in a content-addressable store, for lookup and enumeration

I'm implementing a content-addressable file store - similar to a key/value store, but the key is always a hash of the value. I'd like to build an encryption layer for it, to hide what data is being ...
Colonel Thirty Two's user avatar
1 vote
1 answer
7k views

How does AES GCM encryption work

Previously, I used AES CBC 256 with 256 bit key and 128 bit IV. However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as: Auth tag:...
Kim Mỹ's user avatar
  • 155
3 votes
1 answer
176 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
Atul Vani's user avatar
0 votes
1 answer
91 views

Is a static IV really less secure than an IV generated from a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication. ...
Neil Yoga Crypto's user avatar
0 votes
1 answer
29 views

When would we need a bigger IV than 2 bytes when the IV is derived of a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText to offer both authentication and prevent identical cipherTexts. ...
Neil Yoga Crypto's user avatar
1 vote
1 answer
117 views

Is it safe to "compress" an IV in AES256-CTR? [closed]

Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
Guiomar Raissa's user avatar
0 votes
0 answers
64 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
phantomcraft's user avatar
1 vote
0 answers
69 views

What would be the consequences of using a IV smaller than the block size in CBC encryption?

Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
phantomcraft's user avatar
2 votes
2 answers
205 views

What can an attacker do with this in-secure usage of AES-CFB8?

I believe I have found insecure usage of AES-CFB8 in an application I am working on and would hope someone could explain how and why this is insecure and what an attacker could do such as key recovery ...
katoriw701's user avatar
1 vote
1 answer
262 views

AES-128-CFB repeated IV and KPA

I'm doing reverse-engineering a product and identified a critical issue with it. The work is done and the developer was notified, but for my own personal curiosity, I'd like to learn how to exploit it ...
CryptoInquisitor's user avatar
2 votes
2 answers
512 views

Does keeping IV secret increase security of CTR mode?

Let's suppose I encrypt something with CTR mode and keep the key and IV secret. Does keeping the IV secret together with the key increase strength of encryption?
phantomcraft's user avatar
4 votes
1 answer
936 views

Java: SecureRandom.getInstanceStrong() vs new SecureRandom()

Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
automatictester's user avatar
2 votes
2 answers
941 views

Distinguishing the correct IV from incorrect IV in AES CBC when key is known

Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
Bharat Malhotra's user avatar
1 vote
1 answer
575 views

Is it okay to avoid a plaintext IV in AES?

The scenario Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.) The goal (explained more later) To avoid sending an unencrypted IV. But since this is being done using .NET ...
ispiro's user avatar
  • 1,985
1 vote
1 answer
142 views

Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?

When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption? For easier ...
krystof18's user avatar
  • 143
0 votes
1 answer
82 views

Can a one time public key'd HMAC be secure?

Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be ...
Paul Uszak's user avatar
  • 15.2k
1 vote
2 answers
510 views

Why is possible to encrypt multiple messages within the same stream in AES

I have a standard random key and IV. Then I am creating a cipher using these keys and iv and then encrypt a specific message. Later on, if I try to encrypt another message with the same cipher(which ...
user avatar
2 votes
1 answer
157 views

Is the tag generated in MAC equal for equal messages in CBC-MAC?

The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
Abhisek Dash's user avatar
1 vote
1 answer
449 views

Safety of AES-256/CBC/PKCS#7 + randomization and reusage of IV

As a start, I'm by any means no expert or anything near that in cryptography. I know the very basic about this, enough to more or less choose a method to implement and then read about it so I knew ...
Edw590's user avatar
  • 113
1 vote
1 answer
166 views

HKDF with predefined IV

Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"? My use-case is an app that ...
martingeorgiu's user avatar
1 vote
1 answer
110 views

How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?

I have a device that needs to communicate with another host and exchange fixed-length messages. All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
Steven's user avatar
  • 131
2 votes
1 answer
328 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
LightBit's user avatar
  • 1,649
1 vote
1 answer
1k views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
jared chong's user avatar
1 vote
0 answers
809 views

How can I decrypt AES-256 GCM with key with a IV that is missing?

I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
Ova Fleming's user avatar
0 votes
0 answers
79 views

Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?

I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
Guest's user avatar
  • 1
0 votes
1 answer
1k views

Decrypting the same message with the same IV using aes-256-cbc

Is it safe to use the same IV when decrypting the exact same encrypted message. From my understanding, there is a security flaw when using the same IV for numerous different messages, as attackers can ...
jayyunit's user avatar

1
2 3 4 5
8