3 ms·
CBC IV does not in general have to be unpredictable. But my main point is that there is no significant difference between block cipher modes in regards to requ
by dfox 12y ago
CBC IV does not in general have to be unpredictable.
But my main point is that there is no significant difference between block cipher modes in regards to requirement for IV as even CTR mode requires IV when used with repeated keys (and arguably repeated IV is more severe concern for CTR mode than for CBC) and conversely, you can just use constant IV for CBC when you can guarantee that used keys are unique.
- ctz 12y ago> CBC IV does not in general have to be unpredictable. Yes, it does. If not, you lose IND-CPA. That is, if it is predictable the attacker gets to test guesses for the plaintext of other blocks. Read Duong and Rizzo, "Here come the XOR Ninjas", 2011. http://www.hpcc.ecs.soton.ac.uk/~dan/talks/bullrun/Beast.pdf http://www.hpcc.ecs.soton.ac.uk/~dan/talks/bullrun/Beast.pdf