Skip to main content
48 votes
Accepted

Is using the same IV in AES similar to not using an IV in the first place?

Lets see if I can clarify things for you. For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
poncho's user avatar
  • 148k
35 votes
Accepted

AES-GCM recommended IV size: Why 12 bytes?

From the proposal of GCM (rewritten if statement): if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else $Y_0 = \operatorname{GHASH}(H, \{\}, IV)$. So there are additional ...
Maarten Bodewes's user avatar
  • 93.2k
33 votes
Accepted

In which cases should the IV be kept secret?

Normally, in a properly designed cryptographic system, everything that must remain secret is either actual data (and the system exactly aims at preserving that confidentiality) or a key. Everything ...
Thomas Pornin's user avatar
26 votes

Is using the same IV in AES similar to not using an IV in the first place?

You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
Squeamish Ossifrage's user avatar
23 votes
Accepted

How bad it is using the same IV twice with AES/GCM?

Even a single AES-GCM nonce reuse can be catastrophic. A single nonce reuse leaks the xor of plaintexts, so if one plaintext is known the adversary can completely decrypt the other. This is the same ...
Squeamish Ossifrage's user avatar
20 votes
Accepted

Why does SHA2-224 use different IV's than SHA2-256?

The $\operatorname{SHA-224}$ is defined in the exact same manner as $\operatorname{SHA-256}$ with different initial values and the digest is obtained truncating the hash value, FIPS PUB 180-4 Page 23. ...
kelalaka's user avatar
  • 49k
15 votes
Accepted

Is deriving the IV from the password secure?

Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
Maarten Bodewes's user avatar
  • 93.2k
13 votes

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
bhass1's user avatar
  • 248
13 votes

AES-GCM recommended IV size: Why 12 bytes?

In the general case, the security goal is to reduce the probability that the internal 128-bit counter block ever takes the same value when instantiating the GCM cipher with a given key. That is ...
SquareRootOfTwentyThree's user avatar
13 votes
Accepted

Relationship between AES GCM and AES CTR

That's correct. In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
Ruggero's user avatar
  • 7,104
12 votes
Accepted

Always set the IV to 0 randomized CBC

This will be dangerous if there is a high probability of repeated initial blocks across plaintext. Cryptographers like to make as few assumptions as possible about the structure of plaintext and so ...
Daniel S's user avatar
  • 24.1k
11 votes

In which cases should the IV be kept secret?

One example of a situation where an "IV" needs to be secret can be found in one of the original papers on the HMAC construction: Bellare, Mihir, Ran Canetti and Hugo Krawczyk. 1996. "Keying hash ...
Luis Casillas's user avatar
11 votes
Accepted

Use Initialization Vector as Additional Authenticated Data

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments. The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
Maarten Bodewes's user avatar
  • 93.2k
11 votes
Accepted

Would it be safe to use the message hash as the IV in ChaCha?

First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
Squeamish Ossifrage's user avatar
10 votes
Accepted

What is the purpose of the "Explicit Nonce" in TLS for AES-GCM and AES-CCM?

This additional 32 bit nonce acts as a salt, and makes multicollision attacks $2^{32}$ times harder. In this attack, the attacker collects a huge number of TLS sessions, each with a record encrypted ...
poncho's user avatar
  • 148k
10 votes
Accepted

Is it ok to transmit an IV as a custom HTTP header?

From a cryptographic standpoint, it doesn't matter how you transmit the IV. You can send it as a header, in the message body, as the path in the request method, or even the URG pointers in a few TCP ...
forest's user avatar
  • 15.3k
10 votes
Accepted

What is the significance of IV in stream ciphers like Trivium?

Role of IV in stream cipher? Like in block ciphers; it helps to achieve randomized encryption. Also, using different IV under the same key prevents the crib-dragging attack like in all stream ...
kelalaka's user avatar
  • 49k
9 votes

Problems with using AES Key as IV in CBC-Mode

This usage is very insecure as it can leak the AES KEY (If decryption is allowed). Consider this case where the server prints the decrypted text. The attacker can modify the $C_i$ to recover the $IV$, ...
Sayooj Samuel's user avatar
9 votes
Accepted

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different ...
fgrieu's user avatar
  • 142k
9 votes
Accepted

Crypto-shredding a file by erasing the IV instead of erasing the Key

No, just erasing the AES-CTR IV is not enough to reliably render the file undecryptable. To see why, consider what happens if the AES key is later compromised, and the attacker also happens to know ...
Ilmari Karonen's user avatar
9 votes

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

Usually. However, if you are using 128-bit AES in CTR mode (remember that GCM is essentially just CTR with authentication), then a kind of attack called a multi-target attack can become possible. This ...
forest's user avatar
  • 15.3k
8 votes
Accepted

Changing the IV of the AES key wrap algorithm

No, not really. If you change the IV to a secret value, you prevent the attacker from checking that the key is correct by comparing to the IV, but they can still check by actually using the key. And ...
otus's user avatar
  • 32.2k
8 votes

Why SHA-512/256 when we already have SHA-384?

The truncated versions of SHA2 are introduced in 2005 and in the Cryptographic hash Workshop, in 2005, Kelsey listed the reasons as; Interoperability and security reasons Need drop-in replacement for ...
kelalaka's user avatar
  • 49k
7 votes
Accepted

using hash function of (key||plaintext) instead of random value for IV

No, it's not semantically secure. Proof: select two plaintexts with identical initial 128 bits; and present them to the Oracle to be encrypted. The resulting ciphertexts will also have identical ...
poncho's user avatar
  • 148k
7 votes
Accepted

Do aes_256_gcm IVs just need to be unique for that key?

For GCM, IV can be predictable (contrary to some other modes such as CBC, there is no unpredictability or uniformness requirement), but they must not be reused. You are free to use any method you wish ...
Thomas Pornin's user avatar
7 votes

Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?

Using different initial values means that finding collisions must be done independently for both algorithms. This is admittedly not an authoritative source, but I found the description in this answer ...
thesquaregroot's user avatar
7 votes
Accepted

AES-GCM cipher - Nonce vs IV

The term for the parameter to AES-GCM that must be unique from message to message for any single key is sometimes called ‘nonce’ and sometimes called ‘IV’. The security contract for AES-GCM requires ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

IV generation best practice for AES-256 CBC

I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure? Almost always, when you see that modern ciphers are ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Yes, you can, but you might not be able to decrypt the first block if you don't know the IV. CBC encryption encrypts block-by-block, using the previous ciphertext XOR'ed with the current plaintext ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes
Accepted

CBC mode with same plaintext

the key and plaintext is the same. The attacker knows this and the IVs used but doesn't know the plaintext. Is there anything to learn about the plaintext when multiple ciphertexts are available ...
mikeazo's user avatar
  • 38.7k

Only top scored, non community-wiki answers of a minimum length are eligible