54 votes
Accepted

Ciphertext and tag size and IV transmission with AES in GCM mode

I'll answer in order: Output size = input size That's correct, GCM uses CTR internally. It encrypts a counter value for each block, but it only uses as many bits as required from the last block. CTR ...
user avatar
  • 85.1k
46 votes
Accepted

Is using the same IV in AES similar to not using an IV in the first place?

Lets see if I can clarify things for you. For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
user avatar
  • 132k
32 votes
Accepted

In which cases should the IV be kept secret?

Normally, in a properly designed cryptographic system, everything that must remain secret is either actual data (and the system exactly aims at preserving that confidentiality) or a key. Everything ...
user avatar
32 votes
Accepted

AES-GCM recommended IV size: Why 12 bytes?

From the proposal of GCM (rewritten if statement): if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$. So there are additional ...
user avatar
  • 85.1k
26 votes

Is using the same IV in AES similar to not using an IV in the first place?

You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
user avatar
20 votes

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

If your IV is predictable this is as (in)secure as assuming that you have a zero vector IV. And a zero vector IV allows you to perform a so-called Adaptive Chosen Plaintext Attack (ACPA). Why? ...
user avatar
  • 345
20 votes

How bad it is using the same IV twice with AES/GCM?

Even a single AES-GCM nonce reuse can be catastrophic. A single nonce reuse leaks the xor of plaintexts, so if one plaintext is known the adversary can completely decrypt the other. This is the same ...
user avatar
19 votes
Accepted

Why does SHA2-224 use different IV's than SHA2-256?

The $\operatorname{SHA-224}$ is defined in the exact same manner as $\operatorname{SHA-256}$ with different initial values and the digest is obtained truncating the hash value, FIPS PUB 180-4 Page 23. ...
user avatar
  • 43.4k
15 votes
Accepted

Need for salt with IV

It sounds like you're using a password-based key derivation function that accepts an optional salt input to convert a passphrase into an encryption key, which you then use to encrypt messages with a ...
user avatar
15 votes
Accepted

Is deriving the IV from the password secure?

Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
user avatar
  • 85.1k
14 votes

Why should I use an Initialization Vector (IV) when I have unique keys?

You should use random IV even when unique keys are used. This prevents key-collision attack where the attacker collects number of cryptograms that have been encrypted with unique keys and brute-...
user avatar
  • 311
14 votes

For AES CBC, can I encrypt the IV with AES ECB and the same key and include it with the message?

It actually leaks information. You are sending: Encrypted IV: $AES(k,IV)$ First ciphertext block of CBC: $AES(k, M_1 \oplus IV)$ Eavesdropper can observe whether the two blocks are equal, which ...
user avatar
  • 10.6k
13 votes

Difference between a nonce and IV

With CBC mode the initialization vector is referred to as IV, because it is not nonce. There are ways to construct nonce so that it does not meet the needs of CBC mode. Random IV is one generation ...
user avatar
  • 5,239
13 votes

How bad it is using the same IV twice with AES/GCM?

Reusing an IV once opens you up to someone finding the XOR of those two plaintext, seriously compromising their confidentiality. Moreover, with GCM, a single IV reuse leaks significant information ...
user avatar
  • 3,547
12 votes
Accepted

How do we compute IV+1 in CTR mode?

The reference for this is NIST SP800-38A, especially its appendix B. Basically we consider the IV a binary value of the width of the block cipher (64-bit for DES, 128-bit for AES), and add 1 to that, ...
user avatar
  • 124k
11 votes

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
user avatar
  • 219
11 votes

In which cases should the IV be kept secret?

One example of a situation where an "IV" needs to be secret can be found in one of the original papers on the HMAC construction: Bellare, Mihir, Ran Canetti and Hugo Krawczyk. 1996. "Keying hash ...
user avatar
11 votes
Accepted

Use Initialization Vector as Additional Authenticated Data

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments. The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
user avatar
  • 85.1k
10 votes

AES key equal to IV (CBC mode)

In this answer I'm assuming that a key is used to encrypt more than one message. The first weakness is that CBC with fixed IV leaks if messages share a common prefix. The second weakness is that it ...
user avatar
10 votes
Accepted

What is the purpose of the "Explicit Nonce" in TLS for AES-GCM and AES-CCM?

This additional 32 bit nonce acts as a salt, and makes multicollision attacks $2^{32}$ times harder. In this attack, the attacker collects a huge number of TLS sessions, each with a record encrypted ...
user avatar
  • 132k
10 votes

AES-GCM recommended IV size: Why 12 bytes?

In the general case, the security goal is to reduce the probability that the internal 128-bit counter block ever takes the same value when instantiating the GCM cipher with a given key. That is ...
user avatar
10 votes
Accepted

Relationship between AES GCM and AES CTR

That's correct. In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
user avatar
  • 6,329
10 votes
Accepted

Is it ok to transmit an IV as a custom HTTP header?

From a cryptographic standpoint, it doesn't matter how you transmit the IV. You can send it as a header, in the message body, as the path in the request method, or even the URG pointers in a few TCP ...
user avatar
  • 13.3k
9 votes
Accepted

Problems with using AES Key as IV in CBC-Mode

CBC mode encrypts as follows: $$ C_0 = E_K(IV\oplus P_0);\\ C_i = E_K(C_{i-1}\oplus P_i), $$ where $P_i$ are plaintext blocks and $C_i$ are ciphertext blocks. Traditionally, IV must be random and is ...
user avatar
9 votes

Whats the point of an IV if public?

Encryption schemes that use IVs will typically use results from previous block (or some counter combined with IV) to generate a pseudo-random bit stream to encrypt or decrypt the next block. Without ...
user avatar
  • 1,089
9 votes
Accepted

Is it safe to reuse a symmetric key when using asymmetric encryption?

The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In ...
user avatar
9 votes
Accepted

Why is ECIES complex?

Wouldn't encrypting a message with AES, then encrypting the (randomly generated) AES key and IV with the EC public key suffice? Yes it would suffice and is what is usually done. However for this to ...
user avatar
  • 44.6k
9 votes
Accepted

Precisely how does CBC mode use the initialization vector?

The schemas from the relevant Wikipedia page really explain it all: As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the ...
user avatar
  • 881
9 votes
Accepted

Would it be safe to use the message hash as the IV in ChaCha?

First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
user avatar
9 votes
Accepted

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different ...
user avatar
  • 124k

Only top scored, non community-wiki answers of a minimum length are eligible