48
votes
Accepted
Is using the same IV in AES similar to not using an IV in the first place?
Lets see if I can clarify things for you.
For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
- 151k
35
votes
Accepted
AES-GCM recommended IV size: Why 12 bytes?
From the proposal of GCM (rewritten if statement):
if $\operatorname{len}(IV) = 96$ then $Y_0 = IV || 0^{31}1$ else
$Y_0 = \operatorname{GHASH}(H, \{\}, IV)$.
So there are additional ...
- 94.5k
28
votes
Accepted
How bad it is using the same IV twice with AES/GCM?
Even a single AES-GCM nonce reuse can be catastrophic.
A single nonce reuse leaks the xor of plaintexts, so if one plaintext is known the adversary can completely decrypt the other. This is the same ...
- 49.5k
26
votes
Is using the same IV in AES similar to not using an IV in the first place?
You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
- 49.5k
20
votes
Accepted
Why does SHA2-224 use different IV's than SHA2-256?
The $\operatorname{SHA-224}$ is defined in the exact same manner as $\operatorname{SHA-256}$ with different initial values and the digest is obtained truncating the hash value, FIPS PUB 180-4 Page 23.
...
- 49.5k
15
votes
Accepted
Is deriving the IV from the password secure?
Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
- 94.5k
14
votes
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
- 258
13
votes
AES-GCM recommended IV size: Why 12 bytes?
In the general case, the security goal is to reduce the probability that the internal 128-bit counter block ever takes the same value
when instantiating the GCM cipher with a given key. That is ...
- 1,745
13
votes
Accepted
Relationship between AES GCM and AES CTR
That's correct.
In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
- 7,184
12
votes
Accepted
Always set the IV to 0 randomized CBC
This will be dangerous if there is a high probability of repeated initial blocks across plaintext. Cryptographers like to make as few assumptions as possible about the structure of plaintext and so ...
- 26.4k
11
votes
Accepted
Use Initialization Vector as Additional Authenticated Data
You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments.
The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
- 94.5k
11
votes
Accepted
Would it be safe to use the message hash as the IV in ChaCha?
First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
- 49.5k
10
votes
Accepted
Is it ok to transmit an IV as a custom HTTP header?
From a cryptographic standpoint, it doesn't matter how you transmit the IV. You can send it as a header, in the message body, as the path in the request method, or even the URG pointers in a few TCP ...
- 15.5k
10
votes
Accepted
What is the significance of IV in stream ciphers like Trivium?
Role of IV in stream cipher?
Like in block ciphers; it helps to achieve randomized encryption. Also, using different IV under the same key prevents the crib-dragging attack like in all stream ...
- 49.5k
9
votes
Problems with using AES Key as IV in CBC-Mode
This usage is very insecure as it can leak the AES KEY (If decryption is allowed).
Consider this case where the server prints the decrypted text.
The attacker can modify the $C_i$ to recover the $IV$, ...
- 191
9
votes
Accepted
Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?
The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different ...
- 145k
9
votes
Accepted
Crypto-shredding a file by erasing the IV instead of erasing the Key
No, just erasing the AES-CTR IV is not enough to reliably render the file undecryptable.
To see why, consider what happens if the AES key is later compromised, and the attacker also happens to know ...
- 46.5k
9
votes
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
Usually. However, if you are using 128-bit AES in CTR mode (remember that GCM is essentially just CTR with authentication), then a kind of attack called a multi-target attack can become possible. This ...
- 15.5k
8
votes
Why SHA-512/256 when we already have SHA-384?
The truncated versions of SHA2 are introduced in 2005 and in the Cryptographic hash Workshop, in 2005, Kelsey listed the reasons as;
Interoperability and security reasons
Need drop-in replacement for ...
- 49.5k
7
votes
Accepted
using hash function of (key||plaintext) instead of random value for IV
No, it's not semantically secure.
Proof: select two plaintexts with identical initial 128 bits; and present them to the Oracle to be encrypted. The resulting ciphertexts will also have identical ...
- 151k
7
votes
Accepted
Do aes_256_gcm IVs just need to be unique for that key?
For GCM, IV can be predictable (contrary to some other modes such as CBC, there is no unpredictability or uniformness requirement), but they must not be reused. You are free to use any method you wish ...
- 87.8k
7
votes
Which attacks are prevented by the different initial hash values for SHA-2 with truncated output?
Using different initial values means that finding collisions must be done independently for both algorithms.
This is admittedly not an authoritative source, but I found the description in this answer ...
- 1,269
7
votes
Accepted
AES-GCM cipher - Nonce vs IV
The term for the parameter to AES-GCM that must be unique from message to message for any single key is sometimes called ‘nonce’ and sometimes called ‘IV’.
The security contract for AES-GCM requires ...
- 49.5k
7
votes
Accepted
IV generation best practice for AES-256 CBC
I saw some SWIFT code that generates IV for AES 256 from selecting 16
characters from a-zA-Z0-9 space.
Is this secure? Sufficiently secure?
Almost always, when you see that modern ciphers are ...
- 94.5k
6
votes
Is IV needed in ECIES?
Pedantically, you always have an IV with AES-CTR; you need to start counting somewhere. So, your question really is "do I need an explicit IV, or can I use an implicit all-0 IV"?
With AES-CTR, the ...
- 151k
6
votes
Accepted
How to choose the size of the IV in AES-GCM?
But how to choose the IV's size and how - if so - it affects the
security of the algorithm?
You really want to give 96-bit IVs to GCM (pad them if neccessary).
If you pick any IV size but 96-bit, ...
- 46.4k
6
votes
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Yes, you can, but you might not be able to decrypt the first block if you don't know the IV.
CBC encryption encrypts block-by-block, using the previous ciphertext XOR'ed with the current plaintext ...
- 94.5k
6
votes
Accepted
When it is safe to reuse IV? (or not using at all)
It is safe to reuse AES-CTR IV (or not use one at all) in some theoretical situations, including when all except one plaintext are uniformly random and independently chosen. However, that's unsafe in ...
- 145k
6
votes
Accepted
Is an IV useless for encrypting database IDs?
The mode of operation does not just matter; it defines the properties of the IV! The mode of operation is the part that specifies the size of the IV, the contents of the IV as well as the impact of ...
- 94.5k
6
votes
Always set the IV to 0 randomized CBC
When you use same key and same IV, same plaintext will be encrypted into same ciphertext.
Moreover, if you have two plaintext, that share first X blocks and the differ, those X blocks will same after ...
- 61
Only top scored, non community-wiki answers of a minimum length are eligible