4 ms·
> Here's the thing about the IV: it's conceptually > ciphertext. It's a public value. Anybody can see it. > The only thing it's not supposed to be is predicta
by antirez 16y ago
> Here's the thing about the IV: it's conceptually
> ciphertext. It's a public value. Anybody can see it.
> The only thing it's not supposed to be is predictable
> or repeatable.
You don't need the IV to be non predictable, as long as it is a different string every time it's all ok. The outcome of the encryption is also related to the first block of real plaintext, so your IV can just be a few random bytes with a decent distribution: no need for a cryptographically secure random number generator.
- almost 16y agoI'm confused, didn't the parent comment just explain why it MUST be unpredictable? Doesn't the attack tptacek describes use the fact that the IV is predictable?
- deleted 16y ago[deleted]
- tptacek 16y agoNo, it helps you not-at-all that the IV hasn't been repeated; again: the attack is, "knowing what I know about the IV you're going to use to encrypt a plaintext I feed you, I'm going to feed you a plaintext that cancels out two IVs so I can use you as an oracle for any ciphertext block". Also, answer my email! =)