3 ms·

Question about IVs: is it enough that the IV is unique, or does it have to be random? If I used a sequence that starts at 1 and is guaranteed to increment for e

by guan 15y ago

Question about IVs: is it enough that the IV is unique, or does it have to be random? If I used a sequence that starts at 1 and is guaranteed to increment for each message and never be reused, is that a good IV?

Robin_Message 15y ago
It is XOR-ed with the first block to mask any pattern there, so a sequence is enough unless you think that the first blocks XOR-ed with a sequence might result in repeats, if for example they also contained a sequence. One obvious option that might work (I'm not a cryptography researcher, so ignore me) is that you could encrypt the sequenced IV to get a secure psuedo-random block.
anologwintermut 15y ago
It absolutely needs to be random. If not, the adversary can predict the IV and use that to conduct either a chosen plaintext or ciphertext attack. This is what happened to SSL a few months ago. See http://crypto.stackexchange.com/questions/1078/how-does-a-cipher-block-chaining-cbc-attack-work-against-ssl/1082#1082 http://crypto.stackexchange.com/questions/1078/how-does-a-ci... for an explanation.
- atonse 15y ago
  In a way, an IV is similar to the idea of the salt used in Hashes. It's supposed to make it harder to find patterns in your ciphertext (or with a hash, harder to generate the hash for every known character range you care about). So in that sense, just like it's good to have a different or random salt with each hash, you'd want a differend (random) IV for each session.
  - dlitz 15y ago
    A salt is really just a nonce: It doesn't have to be random or unpredictable; it just has to be globally unique so that attackers can't work to crack more than one password at once (or pick out identical passwords given a list of password hashes). We make it random because that's the only way we know how to create globally-unique numbers in our decentralized network. CBC-mode's IV really does need to be unpredictable by anyone who can influence the plaintext. Otherwise, you get things like this: http://www.youtube.com/watch?v=BTqAIDVUvrU http://www.youtube.com/watch?v=BTqAIDVUvrU

by guan 15y ago

Robin_Message 15y ago

It is XOR-ed with the first block to mask any pattern there, so a sequence is enough unless you think that the first blocks XOR-ed with a sequence might result in repeats, if for example they also contained a sequence. One obvious option that might work (I'm not a cryptography researcher, so ignore me) is that you could encrypt the sequenced IV to get a secure psuedo-random block.

anologwintermut 15y ago

It absolutely needs to be random. If not, the adversary can predict the IV and use that to conduct either a chosen plaintext or ciphertext attack. This is what happened to SSL a few months ago. See http://crypto.stackexchange.com/questions/1078/how-does-a-cipher-block-chaining-cbc-attack-work-against-ssl/1082#1082 http://crypto.stackexchange.com/questions/1078/how-does-a-ci... for an explanation.

atonse 15y ago
In a way, an IV is similar to the idea of the salt used in Hashes. It's supposed to make it harder to find patterns in your ciphertext (or with a hash, harder to generate the hash for every known character range you care about). So in that sense, just like it's good to have a different or random salt with each hash, you'd want a differend (random) IV for each session.
- dlitz 15y ago
  A salt is really just a nonce: It doesn't have to be random or unpredictable; it just has to be globally unique so that attackers can't work to crack more than one password at once (or pick out identical passwords given a list of password hashes). We make it random because that's the only way we know how to create globally-unique numbers in our decentralized network. CBC-mode's IV really does need to be unpredictable by anyone who can influence the plaintext. Otherwise, you get things like this: http://www.youtube.com/watch?v=BTqAIDVUvrU http://www.youtube.com/watch?v=BTqAIDVUvrU