Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Is it normal that when I use Double DES secret key to encrypt a string in DES3 CBC mode then I always get the same cipher text? For testing I'm using IVC=0.

share|improve this question
1  
Are you using a standard .NET library, or something you picked up online? Got a code snippet? – MToecker Sep 15 '11 at 21:03

2 Answers

up vote 2 down vote accepted

If you encrypt the same thing it is normal, if you encrypt something different it is not normal. In that case you have probably an error in your implementation.

A common error is to translate the encrypted result to string for transport, all non-readable bytes are then changed to "?" by .net.

share|improve this answer
Yes, im encrypting exactly the same thing. I,m not translating the result to string, im just comparing the bytes what il get back from the Encrypt function. – ddsd Sep 16 '11 at 6:11
That's why a good encryption algorithms like AES takes an IV (initialization vector). The IV has many similarities with the salt when hashing passwords. It makes sure that even though you encrypt the same text, the cipher text becomes different (as long as you use a different IV of course) – Erlend Sep 17 '11 at 11:33
IV has nothing to do with DES nor AES. IV's are used in some modes of blockciphers (CBC for example). – Henri Sep 19 '11 at 18:49
Thanks, i had an error in my solution (The IV wasn't passed to the mechanism properly) – ddsd Sep 20 '11 at 6:54
up vote 0 down vote

Yes, if the IV is the same and the message is the same, then you should expect the ciphertext to be the same.

I hope you are aware that using a fixed IV (like IV=0) is insecure. (The reference to double DES is also puzzling. Double DES is insecure. Of course, you also mention DES3, so if you meant triple DES, then this comment can be ignored.) In addition, if you are using encryption without authentication, that is also likely to be insecure.

Instead of putting together your own encryption, I suggest you use a standard scheme, such as the OpenPGP data encryption format (for data at rest) or SSL/TLS (for communication channels).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.