3 ms·

This article is wrong. There are serious attacks against CBC with a zero IV. A zero or re-used IV should not be used with CBC under any circumstances. The auth

by gwillen 15y ago

This article is wrong. There are serious attacks against CBC with a zero IV. A zero or re-used IV should not be used with CBC under any circumstances. The author is correct that ECB is weaker than CBC with a zero IV. This is because there are serious attacks against ECB, and ECB should not be used under any circumstances. (EDIT: I am not passing any judgement on Apple's choice of API defaults; that's something people should feel free to argue about, and they will. I am only pointing out that the author is mistaken to imply that using CBC with a zero IV is safe or advised under any circumstances, which it is most assuredly not.)

ComputerGuru 15y ago
I saw the post as more of an attack against all those people saying that IVs must not ever be made public. You'd be surprised at who I've heard perpetuating these claims, ranging from developers to cryptography professors at 2nd-tier universities. On that point, the OP is spot on as IVs are not meant to be secret their job is just to prevent detection of patterns, i.e. seed randomizers in many ways. And, yes, they shouldn't be reused. If they're being reused, they may as well not be there.
- atonse 15y ago
  Agreed. I'd also note that ECB, CBC, etc, have basically nothing to do with the _algorithm_ being used (in this case, AES). The idea of an IV, ECB, CBC, etc are just techniques to be used to make the results of block ciphers more secure, regardless of what algorithm they use. That's my bigger problem with the "AES is broken on iOS" claim based on IVs. The two things are only loosely related.
dlitz 15y ago
Yes, the article is wrong, but ordinary developers shouldn't be using these low-level APIs anyway, unless they're implementing another, higher-level security protocols (such as OpenPGP, PKCS#5, PKCS#1, SSL, or SSH). I'm not familiar with iOS. Does Apple's SDK provide implementations of any of these higher-level protocols?

by gwillen 15y ago

ComputerGuru 15y ago

I saw the post as more of an attack against all those people saying that IVs must not ever be made public. You'd be surprised at who I've heard perpetuating these claims, ranging from developers to cryptography professors at 2nd-tier universities. On that point, the OP is spot on as IVs are not meant to be secret their job is just to prevent detection of patterns, i.e. seed randomizers in many ways. And, yes, they shouldn't be reused. If they're being reused, they may as well not be there.

atonse 15y ago
Agreed. I'd also note that ECB, CBC, etc, have basically nothing to do with the _algorithm_ being used (in this case, AES). The idea of an IV, ECB, CBC, etc are just techniques to be used to make the results of block ciphers more secure, regardless of what algorithm they use. That's my bigger problem with the "AES is broken on iOS" claim based on IVs. The two things are only loosely related.

dlitz 15y ago

Yes, the article is wrong, but ordinary developers shouldn't be using these low-level APIs anyway, unless they're implementing another, higher-level security protocols (such as OpenPGP, PKCS#5, PKCS#1, SSL, or SSH). I'm not familiar with iOS. Does Apple's SDK provide implementations of any of these higher-level protocols?