4 ms·
It absolutely needs to be random. If not, the adversary can predict the IV and use that to conduct either a chosen plaintext or ciphertext attack. This is what
by anologwintermut 15y ago
It absolutely needs to be random. If not, the adversary can predict the IV and use that to conduct either a chosen plaintext or ciphertext attack. This is what happened to SSL a few months ago.
See http://crypto.stackexchange.com/questions/1078/how-does-a-cipher-block-chaining-cbc-attack-work-against-ssl/1082#1082 http://crypto.stackexchange.com/questions/1078/how-does-a-ci... for an explanation.
- atonse 15y agoIn a way, an IV is similar to the idea of the salt used in Hashes. It's supposed to make it harder to find patterns in your ciphertext (or with a hash, harder to generate the hash for every known character range you care about). So in that sense, just like it's good to have a different or random salt with each hash, you'd want a differend (random) IV for each session.
- dlitz 15y agoA salt is really just a nonce: It doesn't have to be random or unpredictable; it just has to be globally unique so that attackers can't work to crack more than one password at once (or pick out identical passwords given a list of password hashes). We make it random because that's the only way we know how to create globally-unique numbers in our decentralized network. CBC-mode's IV really does need to be unpredictable by anyone who can influence the plaintext. Otherwise, you get things like this: http://www.youtube.com/watch?v=BTqAIDVUvrU http://www.youtube.com/watch?v=BTqAIDVUvrU