3 ms·
In a way, an IV is similar to the idea of the salt used in Hashes. It's supposed to make it harder to find patterns in your ciphertext (or with a hash, harder t
by atonse 15y ago
In a way, an IV is similar to the idea of the salt used in Hashes. It's supposed to make it harder to find patterns in your ciphertext (or with a hash, harder to generate the hash for every known character range you care about).
So in that sense, just like it's good to have a different or random salt with each hash, you'd want a differend (random) IV for each session.
- dlitz 15y agoA salt is really just a nonce: It doesn't have to be random or unpredictable; it just has to be globally unique so that attackers can't work to crack more than one password at once (or pick out identical passwords given a list of password hashes). We make it random because that's the only way we know how to create globally-unique numbers in our decentralized network. CBC-mode's IV really does need to be unpredictable by anyone who can influence the plaintext. Otherwise, you get things like this: http://www.youtube.com/watch?v=BTqAIDVUvrU http://www.youtube.com/watch?v=BTqAIDVUvrU