Questions tagged [initialization-vector]

Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.

Filter by
Sorted by
Tagged with
2
votes
1answer
74 views

Can you change an AES encrypted message if you control the IV?

Let's say that an attacker has the plaintext, the ciphertext and the IV of a specific message. If the attacker can control the ciphertext and the IV, could he forge valid plaintext? Let's say that the ...
-2
votes
0answers
34 views

Hypothetical AES CBC hash function collision resistant?

If we consider a hypothetical hash function H defined by AES-CBC where it encrypts n-blocks (C1,C2,C3..Cn) and the hash value is the last cipher text block - Cn. IV and Key are predefined values ...
1
vote
0answers
30 views

Changing a bit in IV of MD5

It is obvious that changing even one bit in data or IV (initialization vector) will change the hash value a lot. I want to know if, for example, changing a single bit within the $IV$ in MD5 can be ...
5
votes
1answer
66 views

The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D

The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
1
vote
1answer
49 views

Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?

I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
0
votes
1answer
38 views

Why would you want to keep the Initialization Vectors Public?

So I was researching Initialization Vectors (IV) and even took a look at this thread... What is the main difference between a key, an IV and a nonce? ,but I was hoping that I could get some clarity. ...
0
votes
1answer
39 views

Safety of a private key when knowing the full content of an encrypted message in case of fixed initialization vector

When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector? Meaning if ...
1
vote
1answer
39 views

Number message limits of Galois/Counter Mode (GCM) per key

In https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf page 27, it is said that ...the total number of blocks of plaintext and AAD that are protected by invocations of the ...
7
votes
2answers
936 views

Why SHA-512/256 when we already have SHA-384?

Both of them are just SHA-512 with different IV's and truncation. What's the point of having 2 of them? (Actually we have 3 of them as SHA-512/224 is the exact same thing.)
2
votes
2answers
106 views

Extending AES-GCM initialization vector

We all know that applications of crypto primitives like to not think about the management of nonces, and initialization vectors and often prefer to just set them to random values. This sometimes leads ...
10
votes
1answer
1k views

Why does SHA2-224 use different IV's than SHA2-256?

Given that it's otherwise just a truncation, I can guess that being able to compute the 224 value from the 256 value is an unwanted property, but that's just speculation.
1
vote
2answers
47 views

Multiple IV CBC

CBC's encryption is not paralelizable but I could divide a 64 block message in 4 16 block parts and encrypt those 4 parts separatly in parallel using a diferent IV for each one. Is this unsecure ? Is ...
0
votes
2answers
121 views

Find IV and the key ? AES with CFB or OFB

I have a question about the AES-128 and AES-256 encryption method. I need to encrypt 64-bit size data in and out. I want to encrypt them with AES. So I turned to AES-OFB or AES-CFB because these ...
2
votes
0answers
47 views

Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?

Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
1
vote
1answer
111 views

Encryption with Web Crypto API (SubtleCrypto)

I want to end-to-end encrypt items in a stateless environment. These items have an identifier (random string). Now I want to add encryption by adding a random key. The URL could be ...
1
vote
1answer
43 views

JOSE: JWE CEK Initialization Vector Position or Reuse

So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content. My issue however is that NaCl needs an IV (nonce in NaCl) for ...
0
votes
1answer
46 views

AES-256 CTR with ESSIV, is this correct?

I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is: ...
3
votes
1answer
77 views

Number of keystreams generated in Kreyvium for a single key/IV pair

Kreyvium employs 128-bit key and 128-bit IV. By a single initialization procedure using a key/IV pair, how many keystreams can be generated?
1
vote
1answer
87 views

ECRYPT Salsa20 Test Vectors Interpretation

I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I ...
1
vote
1answer
111 views

Crypto system design : How to design Encryption for Zero width characters

Zero width character's can be used to hide text in plain sight.I am building a system where user's can provide their secret message , cover message and a password (key) which I would encrypt and give ...
1
vote
0answers
39 views

Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?

Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
5
votes
1answer
413 views

What is the significance of IV in stream ciphers like Trivium?

In Trivium cipher, an 80-bit key and 80-bit IV (initialization vector) are used initially to set up the initial state. I would like to know, Role of IV in stream cipher? Can we make IV a secret ...
1
vote
1answer
49 views

When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?

The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following: $$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$ https://en....
3
votes
1answer
73 views

If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
2
votes
2answers
147 views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
2
votes
1answer
600 views

IV generation best practice for AES-256 CBC

I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure? What is the best practice to generate IV for AES 256? Will ...
2
votes
1answer
175 views

Finding the IV values of SHA-256 given all message blocks

Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with ...
2
votes
1answer
37 views

Longer IV generation from a single block IV for ICBC

I was reading a question about ICBC here and it mentioned that you would need a $s \cdot n$-bit $IV$ if you would use $s$ "stripes", where $n$ is the blocksize. Say that we don't like transmit that ...
2
votes
1answer
47 views

Reusing IV but still generating different code?

I'm in a beginner's cryptography class and I'm trying to figure out if I'm doing something wrong, or if I just don't understand why something is the way it is. I created a simple .txt file of 124 ...
2
votes
3answers
2k views

Does the Initialization Vector in DES have to be 8 bytes long?

I was experimenting around with DES and decided to implement an IV (Initialization Vector) for it. I noticed that in DES, which is 56 bits and 8 parity bits, the IV would be 8 bytes in length. Does ...
3
votes
2answers
1k views

Given the key, the plain text and the cipher text can I calculate the IV used in CBC mode?

If I have the plain text, the ciphertext and the key for an AES-128 CBC operation, can I determine the IV, even if I don't know the padding (assuming the padding follows one of the more common formats)...
2
votes
1answer
39 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
0
votes
2answers
346 views

How to generate a 128 bit IV from a 32 bit value for AES-128 OFB

I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value 0x9a23773c (...
1
vote
1answer
316 views

How does reusing IV for OFB mode breaks the scheme

Consider a Plaintext P1 and Ciphertext P2, which is known to the attacker. If the attacker knows that the IV used in encrypting P1 in OFB mode is the same used to encrypt another plaintext P2, how can ...
2
votes
2answers
419 views

using different IV and SALT with AES-CBC but same KEY

I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC. Now, each time I encrypt something, ...
1
vote
1answer
47 views

Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?

Let || be the concatenation operator. Let CipherText = AES(Key1, IV, Message). Let us assume AES is used in CBC mode. I want ...
2
votes
3answers
235 views

AES Cipher Block Chaining 128 bit message

I understand that for AES CBC you need to split the plaintext up into blocks and perform XOR'ing using the previous blocks calculations etc. However, if your message is exactly 128 bits long, do you ...
3
votes
1answer
171 views

Best practices for IV generation

What are the best practices for IV generation for AES and other algorithms? Is RNG enough? What if I cannot use RNG and need to use a variable that is related to some characteristic of the ...
0
votes
0answers
45 views

Is it possible to encrypt a message stream with the same IV each time and for it to be secure?

I know we should ideally never reuse the IV (Depending upon the mode of encryption used), but is it possible to have a protocol which uses the same IV for the message stream and is as safe as one ...
1
vote
1answer
130 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
0
votes
1answer
67 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
0
votes
1answer
160 views

Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?

I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set ...
3
votes
1answer
358 views

AES-CBC streaming configuration IV usage

I am interested in the implications of using AES-CBC in a streaming configuration. Reading the specifications of a few protocols I notice that when using AES-CBC they include IV + ciphertext + HMAC ...
0
votes
1answer
98 views

It is the IV shared in CBC mode?

I don't know if the IV in CBC mode is equal in both sides of the encryption and decryption operations. I know that the IV must be unpredictable, but has it to be MACed in the encryption side to be ...
2
votes
1answer
2k views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
2
votes
3answers
916 views

What happens if you increment MAX counter in AES-CTR?

Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
0
votes
1answer
143 views

Signal Protocol Header key encryption initialization vector

In Signal Protocol when you use a Double Ratchet you have 2 options: Normal encryption = header + ciphertext Encrypted header encryption = ...
3
votes
2answers
122 views

Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector?

I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature: ...
0
votes
2answers
347 views

IVs in WEP encryption

First, I'm pretty new to the world of encryption. As I understand it, in WEP, the plaintext and CRC are XOR'd with the IV and the key (or more accurately, the key/stream, which is produced by a pseudo-...
0
votes
0answers
167 views

Is it possible to recover the key to a decrypted file? [duplicate]

Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged in CBC mode? If so how? The file I want to recover the key from is a xml that ...

1
2 3 4 5
7