If we agree that using a null IV for AES in CBC and GCM mode is not a good idea, but for whatever reason one is encouraged to use a null vector for several messages using the same key, is there a "least worst" option between the two modes ?

  • 2
    This answer applies. Just replace "CTR" with "GCM" when you read it. – Xander May 6 '19 at 19:26
  • Use AES-GCM_SIV mode which is designed for IV reuse. – kelalaka May 7 '19 at 10:28
  • @kelalaka Not in this use-case: they are not accidental re-uses, the number of re-use is too big for AES-SIV. – A. Hersean May 7 '19 at 13:40

You should not do this, but if you must, use CBC.

GCM is like CTR mode, but with an authentication tag built into it. Unfortunately, if the nonce (IV) is reused, an attacker can recover the key used for authentication, making the authentication tag all but useless. Now you're basically using CTR mode, and CTR mode does not deal well with nonce reuse. An attacker can recover the XOR of any plaintexts encrypted with the same nonce.

With CBC mode each plaintext block is XORed with the previous ciphertext block, but the first plaintext block is instead XORed with the IV. When an IV is reused, an attacker can tell if the plaintexts share a prefix with a length divisible by the block size (ie you can tell if there is a 16 byte, 32 byte, etc prefix).

Edit: As Xander points out, since GCM's authentication tag is broken when a nonce is reused, this answers your question.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.