Questions tagged [initialization-vector]

Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.

Filter by
Sorted by
Tagged with
1
vote
1answer
76 views

Crypto system design : How to design Encryption for Zero width characters

Zero width character's can be used to hide text in plain sight.I am building a system where user's can provide their secret message , cover message and a password (key) which I would encrypt and give ...
4
votes
2answers
316 views

Is it ok to transmit an IV as a custom HTTP header?

Considering an AES OFB encryption algorithm, suppose that I'm sending a message over HTTP (not HTTPS) and my message body contains the cyphertext. I'd like to know if transmitting a random ...
18
votes
4answers
2k views

Is it safe to use file's hash as IV?

I'm encrypting some files using AES in CBC mode. I'm also using file's digest (SHA-1) to check that data is decrypted correctly (so I need to store it with file). Is it safe to use this digest as ...
0
votes
1answer
56 views

Randomly initialised global counter used to encrypt the kth message with IV = IV + k mod 2^n

The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then IV + 1 for the second , IV + 2 for the 3rd etc. How can I construct an attack to ...
1
vote
0answers
37 views

Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?

Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
17
votes
3answers
16k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
33
votes
4answers
30k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
4
votes
3answers
4k views

Validating successful decryption in AES

I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ...
5
votes
1answer
287 views

What is the significance of IV in stream ciphers like Trivium?

In Trivium cipher, an 80-bit key and 80-bit IV (initialization vector) are used initially to set up the initial state. I would like to know, Role of IV in stream cipher? Can we make IV a secret ...
1
vote
1answer
45 views

When using CBC-ESSIV for disk encryption, why does the generation of IV require a hash then encryption instead of only one hash?

The CBC-ESSIV algorithm specifies how to calculate the IV to use for a given key (K) and sector number (S) as the following: $$\text{IV} = \operatorname{Enc}(\operatorname{Hash}(K) , S)$$ https://en....
3
votes
1answer
61 views

If I allow arbitrary initial hash values for SHA-256, what would be the weaknesses?

The initial hash values (IV) of SHA256 are fixed. However, let's say I modify the SHA256 hash function to allow the attacker to use arbitrary IVs rather than fixed IVs. What kind of weaknesses would ...
2
votes
2answers
84 views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
2
votes
1answer
180 views

IV generation best practice for AES-256 CBC

I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure? What is the best practice to generate IV for AES 256? Will ...
1
vote
2answers
110 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
1
vote
1answer
312 views

Alter plaintext through IV in block cipher AES in CBC mode

IV: 69bb375aa919c72aa561dd7b7ffacf66 Ciphertext: "c28ea025d10186510855d083747d6435c808d9857075abd9bfc54b094e60eaf3" Plaintext: "SEND ENCRYPTED DATA" I want to be able to change the resulting ...
2
votes
1answer
110 views

Finding the IV values of SHA-256 given all message blocks

Given all message blocks $w[i],i \in 0:63$ and assume that $n<128$ (arbitrary) bits $x_1,x_2,...,x_n$ of the IV values are unknown (e.g., $h_7$ bits are unknown) while other IV values coincide with ...
2
votes
1answer
36 views

Longer IV generation from a single block IV for ICBC

I was reading a question about ICBC here and it mentioned that you would need a $s \cdot n$-bit $IV$ if you would use $s$ "stripes", where $n$ is the blocksize. Say that we don't like transmit that ...
2
votes
1answer
46 views

Reusing IV but still generating different code?

I'm in a beginner's cryptography class and I'm trying to figure out if I'm doing something wrong, or if I just don't understand why something is the way it is. I created a simple .txt file of 124 ...
50
votes
2answers
35k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is public? What ...
1
vote
1answer
936 views

crypto design with AES-256 MODE OFB

I have the following APP Design key store (contains 1:n user payload as 1:n key store entries) key store salt (is used to extend to key store password to 256 bits, stored in clear text) key store ...
2
votes
2answers
2k views

AES-256 GCM IV guidelines

If I use for example AES-256 (GCM), and my message is bigger than 256 bit (broken into smaller 256 bit blocks for encryption), should the IV change for every 256 bits of the message?
1
vote
1answer
104 views

Doubts regarding implementing AES-128 bit algorithm in my IOT system

I want to implement AES-128 in my IoT network which consists of a Master device which runs Linux on it and slave devices which are 8-bit micro-controllers that periodically transmit data packets to ...
2
votes
3answers
1k views

Does the Initialization Vector in DES have to be 8 bytes long?

I was experimenting around with DES and decided to implement an IV (Initialization Vector) for it. I noticed that in DES, which is 56 bits and 8 parity bits, the IV would be 8 bytes in length. Does ...
3
votes
2answers
659 views

Given the key, the plain text and the cipher text can I calculate the IV used in CBC mode?

If I have the plain text, the ciphertext and the key for an AES-128 CBC operation, can I determine the IV, even if I don't know the padding (assuming the padding follows one of the more common formats)...
2
votes
1answer
36 views

Security implications of not concatenating a 1 to the IV when using GCM

When using GCM, The padding string $0^{31}||1$ is appended to the IV. I know that this is done to avoid the repetition of $E_K(0^n)$ which is used as key for the GHash. But what would be the security ...
0
votes
2answers
220 views

How to generate a 128 bit IV from a 32 bit value for AES-128 OFB

I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value 0x9a23773c (...
5
votes
4answers
5k views

Problems with using AES Key as IV in CBC-Mode

I'm a pentester and currently analysing a web application which are using some strange encryption scheme. The point is: They encrypt using AES-128, generate a (not cryptographic secure) key and use ...
2
votes
3answers
437 views

AES-CBC with zero IV and a unique first block [duplicate]

Is it safe to generate the IV for AES-CBC as the following? It's like the real IV is all zeros. The first block of data will be a low-entropy but unique data. Once the first block is encrypted, the ...
0
votes
2answers
323 views

Is it required to use a random IV for AES-CBC with random key per message? [duplicate]

I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough. In my case, I generated random AES key for each file to encrypt and decrypt them. My ...
1
vote
1answer
161 views

How does reusing IV for OFB mode breaks the scheme

Consider a Plaintext P1 and Ciphertext P2, which is known to the attacker. If the attacker knows that the IV used in encrypting P1 in OFB mode is the same used to encrypt another plaintext P2, how can ...
2
votes
2answers
256 views

using different IV and SALT with AES-CBC but same KEY

I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC. Now, each time I encrypt something, ...
1
vote
1answer
107 views

Attacking Double DES (OFB Mode) given the initialization vector and not much else? [closed]

I'm given a Plaintext/Ciphertext pair, a Ciphertext to break, and the IV. One thing of note is that the same IV is used for both DES Encryptions, so $$C = E_{K_2}(E_{K_1}(P, IV), IV)$$ I have limited ...
1
vote
1answer
46 views

Is it safe to compute HMAC(Base64(IV) || “,” || Base64(CipherText)) instead of HMAC(IV || CipherText)?

Let || be the concatenation operator. Let CipherText = AES(Key1, IV, Message). Let us assume AES is used in CBC mode. I want ...
2
votes
3answers
190 views

AES Cipher Block Chaining 128 bit message

I understand that for AES CBC you need to split the plaintext up into blocks and perform XOR'ing using the previous blocks calculations etc. However, if your message is exactly 128 bits long, do you ...
1
vote
1answer
1k views

AES in OFB mode and IVs

I'm trying to understand cryptosystems and their implementations to understand how to properly implement them. I have a function implementing AES-128 in OFB mode. Let's call it ...
3
votes
1answer
131 views

Best practices for IV generation

What are the best practices for IV generation for AES and other algorithms? Is RNG enough? What if I cannot use RNG and need to use a variable that is related to some characteristic of the ...
0
votes
0answers
42 views

Is it possible to encrypt a message stream with the same IV each time and for it to be secure?

I know we should ideally never reuse the IV (Depending upon the mode of encryption used), but is it possible to have a protocol which uses the same IV for the message stream and is as safe as one ...
0
votes
1answer
120 views

Is the AES-GCM encryption using the SHA256 hash of the plaintext as IV secure?

I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set ...
0
votes
1answer
50 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
11
votes
3answers
2k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
3
votes
1answer
502 views

iOS Data Protection: What is the Input of the LFSR?

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine, which uses the key to encrypt the file ...
3
votes
1answer
342 views

AES-CBC streaming configuration IV usage

I am interested in the implications of using AES-CBC in a streaming configuration. Reading the specifications of a few protocols I notice that when using AES-CBC they include IV + ciphertext + HMAC ...
5
votes
1answer
756 views

AES CBC with unique key per message, but fixed IV

I'm working on a project with a scheme in which c[i] = AES-CBC-Encrypt(msg_key[i], IV, msg[i]), and two distinct plaintexts never have identical keys. ...
0
votes
1answer
78 views

It is the IV shared in CBC mode?

I don't know if the IV in CBC mode is equal in both sides of the encryption and decryption operations. I know that the IV must be unpredictable, but has it to be MACed in the encryption side to be ...
5
votes
1answer
2k views

Encrypting (CBC) identical files with same key and different IV, is it less secure?

I would like to learn more about cryptography. Let's say you encrypt multiple files with CBC encryption using the same key, but each file has a unique (and pseudorandom) IV. Does this weaken the ...
19
votes
2answers
9k views

Why is it insecure to use a randomized IV for CBC-MAC instead of an all-zero IV?

A fixed length CBC-MAC uses an all-zero block as the initialization vector. Suppose that we used a randomized IV instead, and sent the IV along with the tag. So if the message $m$ will be $m = b_1 || ...
3
votes
1answer
1k views

Does an IV need to be used in AES CTR mode?

If I encrypt a message once using AES CTR, will I need an IV? Additionally, if I do use an IV, will I need to send it with the cipher text?
1
vote
1answer
1k views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
2
votes
3answers
791 views

What happens if you increment MAX counter in AES-CTR?

Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
0
votes
2answers
321 views

IVs in WEP encryption

First, I'm pretty new to the world of encryption. As I understand it, in WEP, the plaintext and CRC are XOR'd with the IV and the key (or more accurately, the key/stream, which is produced by a pseudo-...

1
2 3 4 5 6