Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
338
questions
0
votes
1answer
34 views
How to use nonce, counter, and IV in AES-256-CTR?
preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.
how do i construct a valid IV, given a nonce? What does this have to do ...
1
vote
0answers
63 views
How can I decrypt AES-256 GCM with key with a IV that is missing?
I want to decrypt a file that has been encrypted using AES-256 in GCM mode in libressl. I have the key but I don't have the IV, is there any way I can still decrypt?
0
votes
0answers
36 views
Is 64-bit SHA-256 IV-based MAC for fixed-length messages reasonably secure?
I want to use truncate8(SHA256-nopad(IV=secret, message)) as a 64-bit MAC, where message is guaranteed to be exactly one hash ...
0
votes
1answer
48 views
Decrypting the same message with the same IV using aes-256-cbc
Is it safe to use the same IV when decrypting the exact same encrypted message. From my understanding, there is a security flaw when using the same IV for numerous different messages, as attackers can ...
2
votes
2answers
115 views
Secure AES IV with static salt
I have an (offline) shared secret key (symmetric) which is used to encrypt/decrypt data.
Now this data belongs to a specific user which is known on the backend and frontend. My idea was to use the ...
0
votes
0answers
46 views
Do I need an inititalization vector if I don't care about message leaking?
In Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector, an answer says
using a fixed IV is bad practice since it allows statistical ...
0
votes
0answers
33 views
How to allow a partner to encrypt a message that I can decrypt without using a random initialization vector?
My company has a requirement to allow a partner vendor to log people into our web app via some kind of single sign on. We need this to be a simple process for them, not involving the use of ...
0
votes
1answer
75 views
Comparing the security when using fixed IV for CBC and CTR
Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
0answers
56 views
Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)
I want to prove the security of a Tweakable Block Cipher in CBC Mode
How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
2
votes
0answers
39 views
LibTomCrypt Documentation on LRW Mode/Tweakable Block Cipher - Apparent Contradiction?
In the LRW mode discussion on page 34/161 of the LibTomCrypt manual, available here for example
https://opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/Source/libtomcrypt/doc/...
1
vote
1answer
195 views
Finding the IV of AES CBC (CTF)
We have a python program that encrypts/decrypts plaintext given in hex to a cipher using AES CBC. We know that the IV is the same and is not going to change (it is stored in a file). How can we ...
0
votes
1answer
60 views
Is it safe to reuse an IV 100 times to a single key with AES CBC? [duplicate]
I have a unique 6 digit number that I am generating a IV from. I am trying to make it as unique as possible. From my programming, I am able to get it down to only have 100 duplicate IVs per unique 6 ...
0
votes
1answer
89 views
IV in RSA Encrypted Private Key
I have been provided an RSA encrypted private key which was generated in NodeJS (crypto) using the following:
...
1
vote
1answer
78 views
Where is the SIV in AES-GCM-SIV?
This is my understanding of Synthentic IVs
You have 2 keys $K_1$ & $K_2$.
$F$ is a PRF
Instead of choosing a separate IV, you instead generate the IV from the PlainText.
$IV = F(K_1, m)$
$c = E(...
1
vote
0answers
28 views
Is it necessary to use an IV in CBC mode when just encrypting one file? [duplicate]
As far as I know, CBC mode, even with a null IV, will encrypt identical plaintext blocks to unique ciphertext blocks within a single file. The purpose of an IV is to obscure the similarities between ...
0
votes
1answer
77 views
Deterministic Encryption - Generating IV from password key
I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption.
...
3
votes
1answer
215 views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
2answers
118 views
With AES-CTR does the block input need to be implemented as nonce || counter?
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
0
votes
1answer
70 views
What would be the most recommended AES && RSA Keys for production?
While I am a front-end developer and not a security expert programmer, I am worry about the keys I am using for my AES && RSA encryption. Please help me to understand:
Is the following keys ...
2
votes
1answer
96 views
Combining CTR and ECB modes to prevent attacks
In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
0
votes
1answer
60 views
Is it safe to use the CBC-MAC as a Initial Vector and Key Check Value in deterministic encryption?
I want to deterministically encrypt a short message <50 bytes with AES-128 CBC. I also want to be able to detect if the correct key is being used.
Ciphertext and IV integrity will be guaranteed by ...
2
votes
1answer
516 views
Can you change an AES encrypted message if you control the IV?
Let's say that an attacker has the plaintext, the ciphertext and the IV of a specific message. If the attacker can control the ciphertext and the IV, could he forge valid plaintext? Let's say that the ...
1
vote
0answers
40 views
Changing a bit in IV of MD5
It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
5
votes
1answer
130 views
The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D
The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
1
vote
1answer
69 views
Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?
I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
0
votes
1answer
106 views
Why would you want to keep the Initialization Vectors Public?
So I was researching Initialization Vectors (IV) and even took a look at this thread... What is the main difference between a key, an IV and a nonce? ,but I was hoping that I could get some clarity.
...
1
vote
1answer
44 views
Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector
When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector?
Meaning if ...
1
vote
1answer
52 views
Number message limits of Galois/Counter Mode (GCM) per key
In
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
page 27,
it is said that
...the total number of blocks of plaintext and AAD that are protected by
invocations of the ...
7
votes
3answers
1k views
Why SHA-512/256 when we already have SHA-384?
Both of them are just SHA-512 with different IV's and truncation. What's the point of having 2 of them? (Actually we have 3 of them as SHA-512/224 is the exact same thing.)
3
votes
2answers
165 views
Extending AES-GCM initialization vector
We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
10
votes
1answer
1k views
Why does SHA2-224 use different IV's than SHA2-256?
Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.
1
vote
2answers
56 views
Multiple IV CBC
CBC's encryption is not paralelizable but I could divide a 64 block message in 4 16 block parts and encrypt those 4 parts separatly in parallel using a diferent IV for each one. Is this unsecure ? Is ...
0
votes
2answers
335 views
Find IV and the key ? AES with CFB or OFB
I have a question about the AES-128 and AES-256 encryption method. I need to encrypt 64-bit size data in and out. I want to encrypt them with AES.
So I turned to AES-OFB or AES-CFB because these ...
2
votes
0answers
53 views
Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?
Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
1
vote
1answer
293 views
Encryption with Web Crypto API (SubtleCrypto)
I want to end-to-end encrypt items in a stateless environment. These items have an identifier (random string). Now I want to add encryption by adding a random key. The URL could be ...
1
vote
1answer
80 views
JOSE: JWE CEK Initialization Vector Position or Reuse
So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content.
My issue however is that NaCl needs an IV (nonce in NaCl) for ...
0
votes
1answer
57 views
AES-256 CTR with ESSIV, is this correct?
I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is:
...
3
votes
1answer
82 views
Number of keystreams generated in Kreyvium for a single key/IV pair
Kreyvium employs 128-bit key and 128-bit IV. By a single initialization procedure using a key/IV pair, how many keystreams can be generated?
1
vote
1answer
159 views
ECRYPT Salsa20 Test Vectors Interpretation
I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I ...
1
vote
1answer
135 views
Crypto system design : How to design Encryption for Zero width characters
Zero width character's can be used to hide text in plain sight.I am building a system where user's can provide their secret message , cover message and a password (key) which I would encrypt and give ...
1
vote
0answers
47 views
Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?
Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
5
votes
1answer
602 views
What is the significance of IV in stream ciphers like Trivium?
In Trivium cipher, an 80-bit key and 80-bit IV (initialization vector) are used initially to set up the initial state. I would like to know,
Role of IV in stream cipher?
Can we make IV a secret ...
1
vote
1answer
73 views
When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?
The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following:
$$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$
https://en....
4
votes
1answer
107 views
If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?
The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
3
votes
2answers
320 views
Size of IV in AES-GCM according to RFC 4106
RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
2
votes
1answer
2k views
IV generation best practice for AES-256 CBC
I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure?
What is the best practice to generate IV for AES 256? Will ...
2
votes
1answer
216 views
Finding the IV values of SHA-256 given all message blocks
Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with ...
2
votes
1answer
39 views
Longer IV generation from a single block IV for ICBC
I was reading a question about ICBC here and it mentioned that you would need a $s \cdot n$-bit $IV$ if you would use $s$ "stripes", where $n$ is the blocksize.
Say that we don't like transmit that ...
2
votes
1answer
60 views
Reusing IV but still generating different code?
I'm in a beginner's cryptography class and I'm trying to figure out if I'm doing something wrong, or if I just don't understand why something is the way it is.
I created a simple .txt file of 124 ...
2
votes
3answers
3k views
Does the Initialization Vector in DES have to be 8 bytes long?
I was experimenting around with DES and decided to implement an IV (Initialization Vector) for it. I noticed that in DES, which is 56 bits and 8 parity bits, the IV would be 8 bytes in length. Does ...
