Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
393
questions
0
votes
0
answers
53
views
What block cipher should I use for encrypting GCM initialization vector counter-based nonce?
I'm implementing a mobile VPN product based on AES-GCM that should be resistant against fingerprinting the movements of mobile nodes. A difficulty is that the mobile nodes may not have the best ...
- 1,613
2
votes
1
answer
79
views
Is AES-GCM safe if same key is used for both uplink and downlink, assuming last IV bit tells the direction
I have designed a cryptographical protocol which uses AES-GCM with a single key.
I have gone to great lengths to ensure the same initialization vector is never reused. The first bits of the ...
- 1,613
0
votes
0
answers
52
views
How is the IV/Nonce determined in OFB mode? - SQLite Encryption Extension (SEE)
I am doing some research in different methods of encryption for SQLite databases. One of the databases I have is AES-256 OFB encrypted with SEE (https://sqlite.org/see/doc/release/www/readme.wiki). ...
2
votes
1
answer
69
views
Is AES-CTR mode with predictable IV vulnerable to CPA attacks?
I'm just confused about this topic problem.
I know that the CBC mode will be vulnerable to CPA attacks if the IV is predictable, but what about the CTR mode?
1
vote
1
answer
147
views
Putty PPK Encryption Questions (or AES-CBC)
I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
- 123
2
votes
1
answer
182
views
Using AES-CBC with a random number plus a counter for the IV
I understand that AES-CBC uses the following scheme for encrypting data (diagram from Wikipedia):
And, I understand that we don't want initialization vectors to be predictable or constant, and also ...
- 123
0
votes
1
answer
105
views
Do I need to use unique IVs if all encrypted data is unique?
I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
- 103
0
votes
0
answers
90
views
Exposing the vulnerability of CTR mode of operation
In the CTR mode of operation, the plaintext block is treated as a stream cipher, where each byte of the plaintext gets XOR-ed with each byte of the key (which is generated using a nonce and a counter) ...
- 101
3
votes
1
answer
191
views
High volume encryption with AES-GCM: AWS KMS vs CloudHSM
In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS.
Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
- 31
0
votes
2
answers
277
views
Rate the security of the following MAC
Ok we know when we add a random IV in our "modified encrypted" MAC became useless and the IV can be forgery, then our encryption scheme becomes vulnerable to chosen plaintext attacks.
...
- 3
0
votes
1
answer
116
views
CBC KEY recovery when KEY=IV
We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server?
...
- 3
0
votes
0
answers
163
views
CBC Predictable IV Help
I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
- 1
0
votes
0
answers
34
views
How IV value shapes the State Matrix of PHOTON AEAD?
In PHOTON-Beetle Authenticated Encryption algorithm, the state consists of 64 4-bit
elements, which is represented as a (8 × 8) matrix. The Initial Value which consists of Key and Nonce from the ...
3
votes
1
answer
78
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 31
1
vote
1
answer
98
views
Newbie question about AES-GCM and IV
Imagine a channel where the initial secret for deriving of the actual key is established with ECDH.
First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
- 135
2
votes
2
answers
169
views
Recommended way to generate a key and IV for CFB mode?
I need to generate a key and IV that will be used to encrypt multiple things over a period of time with AES in CFB mode. The decision to use AES in CFB mode is not mine to change and the key will only ...
0
votes
0
answers
2k
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
1
vote
1
answer
77
views
Secure encryption in the presence of a keyservice
Imagine this scenario:
On a particular PC is a service that provides cryptographic functions -- in particular AES-CBC and ECC (ECIES/ECDSA).
The service provides access to a single key stored in an ...
- 113
2
votes
1
answer
184
views
AES encryption IV that won't need to be stored
I'm trying to implement an IV that won't need to be stored on it's own.
I'm considering 3 options:
Since I'm using PBKDF to generate a key I could use some bytes from the generated hash
I could use ...
- 23
1
vote
1
answer
54
views
Using Self-Generated Random Bits Instead of the Initialization Vector (IV)
I think my understanding on initialization vector (IV) might be lacking, but as I understand it, an IV is used to create randomness to an encrypted message so that the message is difficult to crack ...
- 113
1
vote
2
answers
226
views
Role of IV in Perl's Crypt::Rijndael
Sorry in advance if I'm asking a stupid question:
I thought the role of "IV" in encryption is to avoid having identical ciphertext for identical plaintext.
So one could use some random IV.
...
- 229
0
votes
1
answer
85
views
Use name as the initialization vector to encrypt passwords for users
I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
3
votes
1
answer
113
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 31
2
votes
1
answer
646
views
Vulnerability due to same IV, same key, same plaintext at same position in OFB
I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the ...
- 23
1
vote
1
answer
50
views
Can the IV be reused if the key is changed?
I am using AES-GCM-256 to encrypt data in a database, and am using a single key that I salt with a unique random value for each user to encrypt their information. I am using the same IV for all of ...
- 300
1
vote
1
answer
529
views
XChaCha20-Poly1305 question about IV's
I've a question about XChaCha20-Poly1305, from a brute force perspective. Suppose we have the power to brute force crack it. If the IV is known to the attacker and it's only one file. The time needed ...
- 13
0
votes
1
answer
281
views
How many bits of encryption are enforced in WEP (wired equivalent protocol)
I'm currently taking a computer security module in University and as part of a problem have been asked:
My thought for the question is that no it does not provide 64 bits of security strength. This ...
- 77
6
votes
2
answers
1k
views
Always set the IV to 0 randomized CBC
Please explain what goes wrong if we always set the IV to 0 in randomized CBC, and use the system to encrypt two different messages m0 /= m1 with the same key k.
I ...
- 183
2
votes
2
answers
182
views
Generating an IV from a constant seed and predictable salt larger than the value space of the IV
I am planning to encrypt multiple values using a 16 byte IV that I'm generating from the below scheme. My seed is a 32 byte ...
user80785
1
vote
0
answers
30
views
Encrypting an IV with XEX using a block cipher and XORing on the plaintext: Is this scheme valid?
I had an idea to make XEX mode parallelizable at CPU level.
Let's suppose I take an IV, XOR with random data, encrypt, XOR again with another data, and XOR on the plaintext
Would this encipherment ...
- 887
1
vote
1
answer
66
views
Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?
A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
- 887
1
vote
1
answer
479
views
How are long IVs used in AES-GCM?
I looked through NIST's official test vectors (CAVP) for the AES-GCM mode, and noticed that there are some test vectors in there with 8-bit or 1024-bit IVs. But as far as I understand, the GCM ...
- 201
2
votes
1
answer
203
views
what is IV predictable?
What is IV predictable in the CBC mode?
We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
- 23
0
votes
0
answers
161
views
How to encrypt keys in a content-addressable store, for lookup and enumeration
I'm implementing a content-addressable file store - similar to a key/value store, but the key is always a hash of the value.
I'd like to build an encryption layer for it, to hide what data is being ...
2
votes
1
answer
13k
views
How does AES GCM encryption work
Previously, I used AES CBC 256 with 256 bit key and 128 bit IV.
However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as:
Auth tag:...
- 165
3
votes
1
answer
214
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 33
0
votes
1
answer
94
views
Is a static IV really less secure than an IV generated from a master key?
As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication.
...
- 303
0
votes
1
answer
29
views
When would we need a bigger IV than 2 bytes when the IV is derived of a master key?
As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText to offer both authentication and prevent identical cipherTexts.
...
- 303
1
vote
1
answer
131
views
Is it safe to "compress" an IV in AES256-CTR? [closed]
Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
user80785
0
votes
0
answers
69
views
Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret
I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
- 887
1
vote
0
answers
88
views
What would be the consequences of using a IV smaller than the block size in CBC encryption?
Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
- 887
2
votes
2
answers
350
views
What can an attacker do with this in-secure usage of AES-CFB8?
I believe I have found insecure usage of AES-CFB8 in an application I am working on and would hope someone could explain how and why this is insecure and what an attacker could do such as key recovery ...
- 23
1
vote
1
answer
389
views
AES-128-CFB repeated IV and KPA
I'm doing reverse-engineering a product and identified a critical issue with it. The work is done and the developer was notified, but for my own personal curiosity, I'd like to learn how to exploit it ...
2
votes
2
answers
599
views
Does keeping IV secret increase security of CTR mode?
Let's suppose I encrypt something with CTR mode and keep the key and IV secret.
Does keeping the IV secret together with the key increase strength of encryption?
- 887
4
votes
1
answer
1k
views
Java: SecureRandom.getInstanceStrong() vs new SecureRandom()
Given SecureRandom class is considered suitable for use in cryptography, I consider new SecureRandom() to be secure (funny term, ...
user80928
2
votes
2
answers
1k
views
Distinguishing the correct IV from incorrect IV in AES CBC when key is known
Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
1
vote
1
answer
677
views
Is it okay to avoid a plaintext IV in AES?
The scenario
Using AES 256 with CBC mode. (Authentication is done separately. Ignored here.)
The goal (explained more later)
To avoid sending an unencrypted IV.
But since this is being done using .NET ...
- 2,025
1
vote
1
answer
182
views
Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?
When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption?
For easier ...
- 143
0
votes
1
answer
87
views
Can a one time public key'd HMAC be secure?
Imagine authentication like $hmac = H(nonce, ciphertext)$. $nonce$ is truly random and chosen (randomly and WITHOUT replacement) from predetermined set $N$. So ${nonce} \in N$ and once used cannot be ...
- 15.7k
1
vote
2
answers
635
views
Why is possible to encrypt multiple messages within the same stream in AES
I have a standard random key and IV. Then I am creating a cipher using these keys and iv and then encrypt a specific message. Later on, if I try to encrypt another message with the same cipher(which ...
user96631