2

When used to encrypt data that is unique, is an Initialization Vector (IV) still required? For example, Credit Card numbers or Social Security numbers.

The ultimate point of an IV is to ensure that the CipherText of two identical PlainText messages is not the same. If the PlainText is unique is there a need for the IV?

3

The role of the IV depends a lot on the encryption system, e.g. whether it is a stream cipher or a block cipher, and, in the latter case, the mode of operation.

IV means Initialization Vector: this is a generic term for the start value of any looping process. In cryptography, we use the term IV to designate a parameter that is used at the start of a computation, changes often, but is not secret (otherwise we would call it a key).

In general, reusing an IV is a mortal sin, but the amount of suffering implied by an IV reuse can vary. In the case of a block cipher in CBC mode, IV reuse immediately leaks whether two messages starts with the same sequence of block; and, more generally, the IV for CBC must be generated randomly, uniformly, and unpredictably, otherwise you are open to Chosen Plaintext Attacks, as was demonstrated in the case of SSL/TLS (where it was popularized under the name "BEAST attack").

If you use a block cipher in CTR or OFB mode, then IV reuse is deadly (it becomes the infamous "two-times pad") leading to easy recovery of the encrypted data. The same applies to stream ciphers that use an IV. In CFB mode IV reuse is a bit less comprehensive in its devastation but it still is dire.

As general rules:

  • An IV shall never be reused for a given key.
  • You can get away with using a fixed IV if (and only if) you never reuse a key. If each key value is ever used for a single message, then a fixed IV can be used. However, since keys are secret while IV are not, changing the IV for each message is considered easier than changing the key for each message (you can convey the IV by including it in an unencrypted file header, for instance).
  • Most attack models that make encryption desirable also allow for malicious alterations, so you also need checked integrity. Combining integrity and encryption is not as easy as it seems; the sane way is to use an encryption mode that does both, which, in practice, means GCM. GCM has its own requirements on IV, namely that an IV shall never be reused, and that is important.
  • Anything which handles credit card numbers is likely to fall in scope of PCI-DSS, and if you ask the question you asked, then chances are that your system does not comply at all with PCI-DSS, at which point it would be wiser to get your hands off your keyboard and rethink your business choices.
  • [+1] mortal sin. – kelalaka Sep 16 '19 at 20:27
2

This is not the only point of initialisation vectors.

The purpose of IV is also to ensure that repeated use of the cryptographic scheme with the same key does not leak information about the key itself. In the same way, this applies internally between blocks in block ciphers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.