I came across this schematic of FEA implementation using RSA and AES:

Suppose that PKB is Bob's public key, PKA is Alice's public key, SKB is Bob's private key, SKA is Alice's private key, Ks is the session key used by AES, IV is the iniitialization vector, and F is the plaintext.

Suppose Alice was to send Bob a message:

C = E_{PKB}(Ks||IV) || E_{Ks}(F) || Sig_{SKA} (E_PKB(Ks||IV) || E_Ks(F))

This ciphertext consists of three components:

E_{PKB}(Ks||IV) - the RSA encrypted AES session key along with IV
E_{Ks}(F) - The AES encrypted plaintext file
Sig_{SKA} (E_PKB(Ks||IV) || E_Ks(F)) - The RSA signature

When Bob receives the message, he will verify and decrypt the ciphertext.

This makes perfect sense except for the IV. I don't know what the IV is used for in this case. It seems that the IV is simply concatenated with the session key. How is this useful and how does Bob deal with the IV when decrypting the session key? What extra security does this provide? This was the schematic which my professor presented when talking about RSA. It could be possible that the IV is not needed at all.


Assuming AES is being used in any mode other than ECB, the IV is used in the AES encryption (the actual encryption is E_{Ks,IV}(F), not just E_{Ks}(F)). Every mode of operation for AES that I'm aware of except for ECB mode requires an initialization vector, that is used for different things depending on the mode (in CTR it's used to produce the keystream; in CBC it's XORed with the first plaintext, etc.) Now, the IV does not need to be secret, so you could just concatenate it to the whole message; I'm not sure why it's encrypted with RSA, instead of having

C = E_{PKB}(Ks) || IV || E_{Ks,IV}(F) || Sig_{SKA} (E_PKB(Ks) || IV || E_{Ks,IV}(F))

But that's why it's present in the first place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.