If we agree that using a null IV for AES in CBC and GCM mode is not a good idea, but for whatever reason one is encouraged to use a null vector for several messages using the same key, is there a "least worst" option between the two modes ?

  • 2
    This answer applies. Just replace "CTR" with "GCM" when you read it.
    – Xander
    May 6, 2019 at 19:26
  • Use AES-GCM_SIV mode which is designed for IV reuse.
    – kelalaka
    May 7, 2019 at 10:28
  • @kelalaka Not in this use-case: they are not accidental re-uses, the number of re-use is too big for AES-SIV.
    – A. Hersean
    May 7, 2019 at 13:40

1 Answer 1


You should not do this, but if you must, use CBC.

GCM is like CTR mode, but with an authentication tag built into it. Unfortunately, if the nonce (IV) is reused, an attacker can recover the key used for authentication, making the authentication tag all but useless. Now you're basically using CTR mode, and CTR mode does not deal well with nonce reuse. An attacker can recover the XOR of any plaintexts encrypted with the same nonce.

With CBC mode each plaintext block is XORed with the previous ciphertext block, but the first plaintext block is instead XORed with the IV. When an IV is reused, an attacker can tell if the plaintexts share a prefix with a length divisible by the block size (ie you can tell if there is a 16 byte, 32 byte, etc prefix).

Edit: As Xander points out, since GCM's authentication tag is broken when a nonce is reused, this answers your question.

Not the answer you're looking for? Browse other questions tagged .