2

Let's say I encrypt a message using AES/CBC twice, with the same key but two different IVs. Is this safe? Or can the resulting ciphertexts be used against each other to obtain information about the plaintext?

Clarification:

I understand that the point of using proper IV values is to prevent equivalent plaintexts from producing equivalent ciphertexts. The question is, given that an attacker knows that the same plaintext was used to generate two different ciphertexts with the same key but two different IVs, does this leak information?

Improve this question
2
  • Essentially the entire point of an IV is to make this exact operation safe.
    – Stephen Touset
    Apr 28, 2015 at 21:26
  • @StephenTouset I clarified my question based on your comment.
    – jdmichal
    Apr 28, 2015 at 21:46

1 Answer 1

Reset to default
1

The question is, given that an attacker knows that the same plaintext was used to generate two different ciphertexts with the same key but two different IVs, does this leak information?

The short answer is "no". If everything goes well, the plain-texts fed into the cipher will all be distinct, and therefore the cipher-texts will all be distinct and the attacker learns nothing. In such a scheme, you are subject however to the inherent weakness of CBC: it only takes 2^(BS/2) blocks before a collision can be expected. Thus using the same key for (a potentially arbitrary number of) different messages might not be such a great idea.

Improve this answer
2
  • Thanks for the reply. So really the worry here is that constantly producing new IVs for the same message drastically increases the chance of a collision, which I assume would give up either the message or the key or both. So persisting the same IV for these objects across the session would reduce collision chances?
    – jdmichal
    Apr 29, 2015 at 13:51
  • Huh? No, the weakness is general to CBC. With AES-128 you should change keys well before you reach 2^64 blocks encrypted with the same key. Keeping the same IV does not help, it is not a question of IV collisions. And such a weakness does not result in key break, just some potential plaintext leaks.
    – Atsby
    Apr 30, 2015 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .