3 ms·

Related question: when using Block Cipher Mode, how does Alice and Bob exchange the IV?

• mcpherrinm 5y ago
  It depends on the protocol and mode, but it’s usually transmitted in the clear along with the encrypted message.
  • slig 5y ago
    Thanks! I thought it had to be somehow not transmitted in the clear.
    • marcan_42 5y ago
      It can also be implied by some other system parameter. As long as the same IV is never reused for the same key, it's safe. For example, if you're encrypting data blobs in some kind of CDN and you never mutate old blobs, your IV can be the blob ID. That said, depending on the construction you use, nonrandom IVs can be a problem (they can leak that there's a relationship between different plaintexts if they line up with a difference in the first block), so you're better off at least making it a random function of the key and said blob/etc ID.
    • bccdee 5y ago
      The IV isn't secret, but in CBC mode it does need to be securely random, otherwise you open yourself up to a class of attacks based on IV prediction. In other modes (CTR, for instance) you can use any nonce you like, so long as you're not reusing it.
• not-elite 5y ago
  Signal message keys seem to include an IV. [1] Message keys are generated by passing a chain key through a key derivation function. [2] So you can also expand a shared secret established through Diffie-Hellman. Someone please correct me if I'm wrong. [1] https://github.com/signalapp/libsignal-protocol-java/blob/master/java/src/main/java/org/whispersystems/libsignal/ratchet/MessageKeys.java https://github.com/signalapp/libsignal-protocol-java/blob/ma... [2] https://signal.org/docs/specifications/doubleratchet/Set0_1.png https://signal.org/docs/specifications/doubleratchet/Set0_1....
• tptacek 5y ago
  The IV (or the nonce, in an AEAD) is usually public, but authenticated; often just appended to the message; with CBC mode, you'd normally prefix the message with the IV, and include the IV in your HMAC.
  • deleted 5y ago
    [deleted]