3

I have read that IV's are used with block ciphers in case a sequence is repeated in a message and produces repeated sequences in the ciphertext.

I see IV's being used in cases where the message is very short, though (e.g. 11 bytes in the example on the attr_encrypted Ruby gem README). Does the use of a unique IV also provide protection in this scenario? If so, how?

1
  • The currently accepted answer (by ThoriumBR) is not correct. Please consider accepting one of the other answers so others who find this question and look at the top answer aren’t misled.
    – Ry-
    Commented Aug 25, 2022 at 19:09

3 Answers 3

2

It protects you from leaking the private key.

If you encode two different texts with the same key, and the attacker have access to both cleartexts and ciphertexts, he can employ Differential Cryptanalysis and maybe recover the private key.

One widely know example is WEP cryptography. It used a short (24-bit) IV and thus encrypted traffic using a repeated IV. This lead to the private key leaking and compromising the network security.

So if you are using the same private key more than once, you must use an IV.

3
  • 3
    Block ciphers should themselves be resistant to differential cryptoanalysis. An good block cipher is a pseudo-random permutation, if it is so vulnerable to differential crypto analysis, the design itself is insecure and must not be used anymore. Maybe it is a reason but not one of the primary reasons for using IV. The reason WEP went down was because it was using RC4 (a stream cipher btw) in a very insecure way, i.e concatenating IV to key. Commented Apr 7, 2021 at 16:55
  • Even then, that attack called related key attack would be somewhat sophisticated one. It was insecure in a sense that having short IV means it would repeat quickly which means you would get the same stream for different messages rather easily. Again, the problem is that key stream would repeat not that the key would leak. And if the block cipher is good enough and message is of single block reusing it for same message would be a problem rather than for different ones because now you can see repeat messages even if you don't know what it is. Commented Apr 7, 2021 at 17:03
  • 1
    Block ciphers is usually associated with symmetric key ciphers so better call it secret key or symmetric key btw. Private key is usually used to refer to private part of asymmetric key pair Commented Apr 7, 2021 at 17:12
5

Now that I can comment I am taking a part of my answer to comment

IV makes your encryption probabilistic and pseudo-random. No deterministic encryption scheme can be semantically secure and they are not IND-CPA, which is a requirement under all modern ciphers. It also allows for streaming mode ciphers to reuse key for many different messages (same as nonce for stream ciphers). Now, if you don't reuse your key at least not for same message and and the message is only one block, then it is OK I think as long as the block encryption is a pseudo random permutation. Repeating key for same message would allow detection of repeated messages (see ECB penguins) which would not be case with semantically-secure scheme with IV. It is notoriously difficult to avoid if you use same key. But it requires people building their own crypto and for InfoSec, it is much better to use state-of-the-art well tested method.

I have read that IV's are used with block ciphers in case a sequence is repeated in a message and produces repeated sequences in the ciphertext.

This is if you encrypt it in ECB mode, i.e. encrypting each block individually. There are ways to encrypt them without using IV to not detect such sequence. But semantic insecurity inherent in fully deterministic encryption scheme still remains if you do not use IV. For example if you use static number in place of IV (or first encrypted block) in CBC mode, you will likely not detect such sequences in the cipher. But you can not only recognize same messages encrypted with the same key but easily detect full block common prefixes in messages.

1

In some cases - with one block of plaintext, an additional block of padding is required, in order to avoid ambiguities during decryption stemming from padding. In these cases, an IV is required, because you now have chaining, due to the fact that there are multiple blocks.

For example, suppose you have one block of ciphertext, and upon decrypting this block, the result is:

b8 13 32 76 39 6d 6c 0e 71 58 ba 80 43 3e fa 01

Notice the last byte, 01. Is this 15 bytes of plaintext, followed by one byte of PKCS#7 padding? Or, is this 16 bytes of plaintext (where the last byte happens to be 01), without any padding?

If the decryptor is following PKCS#7, then the decryptor will think the last byte is padding, and remove this byte from the output.

If the original plaintext is in fact 16 bytes (with the last byte being 01), then this block should be padded with another block of 00 padding bytes, as per PKCS#7, during encryption. This way, there is no ambiguity as to what is padding and what is plaintext during decryption.

In this case, being that the input to the encryptor is now multiple blocks, an IV is necessary.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .