1

Question is the title. To give a bit more information, the same key is used for all ciphertexts and I know ciphertexts C1 and C2 and plaintext P1, which corresponds with C1. The incrementing method for each Ei is also known. I want to find P2.

I can't seem to find an answer since the IV is not known. The first step I took was to do C1 ^ P1 (^ = XOR/direct sum) to get E(K, IV). If I can somehow extract the IV from that then I would be good to go, since I know that C2 ^ E(K, IV) = P2. But I can't find what they used to encrypt K and IV nor can I find it's inverse. If someone knows of a link explaining the process to get IV or the algorithm to encrypt that, please let me know! I've spent a couple hours thinking about this but I can't seem to get it.

  • 1
    E(K, IV) is AES encryption of a single block. You know the key and you know the result, just decrypt the result using the key to obtain the IV. – Marc Sep 21 at 4:36
  • Well that's embarrassing. I guess I had a brainfart for the past few hours. Thanks! – Long Nguyen Sep 21 at 5:01
  • Hold on, I now remember the problem I ran into earlier. My problem is that I couldn't decrypt that without specifying a mode (which requires IV). I tried looking it up and there does happen to be AES-128 decryptors without any mode but they don't work with hex digits. I tried using Java and made sure to use 1 block from E(K, IV) to match the key to decrypt it, but it gives me a BadPaddingError. I am not sure what to do next... – Long Nguyen Sep 21 at 6:10
  • That's more of a programming question. The easiest would be to use a library that lets you use AES directly. You can try on stackoverflow, but be sure to show the code you have tried and specifically what did not work. – Marc Sep 21 at 6:14
1

To recover the lost IV in the given situation, you can make use of the fact that ECB mode (electronic code book) does not use an IV.

Below is a bash/openssl session that illustrates the procedure.
After creating the two plain text files P1 and P2 we create the two cipher text files C1 and C2 using CTR mode.
Then, simulating a situation where both IV and P2 are unknown, we xor C1 and P1, and use the first block of the result (X1) for the decryption using ECB mode, which works without IV. In the result however, we can discover the IV with which P1 has been encrypted (scroll all the way to the right to see the (padded) IV):

~/$ echo -n "The quick brown fox jumped over ..." >P1
~/$ echo -n "... the lazy dog." >P2
~/$ cat P1 | openssl enc -e -aes-128-ctr -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -iv DEADBEEFDEADBEEF >C1
hex string is too short, padding with zero bytes to length
~/$ cat P2 | openssl enc -e -aes-128-ctr -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -iv DEADBEEFDEADBEEF >C2
hex string is too short, padding with zero bytes to length
~/$ ./xor.sh `<P1 bin2hex` `<C1 bin2hex` | hex2bin >X1
~/$ head -c 32 X1 | openssl enc -d -aes-128-ecb -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -p | bin2hex
73616C743D433037343038434344333535303030300A6B65793D41414141414141414141414141414141414141414141414141414141414141410ADEADBEEFDEADBEEF0000000000000000DEADBEEFDEADBEEF00000000000000 

Now, as we know the IV, we can use it to decrypt C2 and get P2, using CTR mode as usual:

~/$ cat C2 | openssl enc -d -aes-128-ctr -iter 1 -K AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -iv DEADBEEFDEADBEEF
hex string is too short, padding with zero bytes to length
... the lazy dog.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.