2

Let's say I encrypt a message using AES/CBC twice, with the same key but two different IVs. Is this safe? Or can the resulting ciphertexts be used against each other to obtain information about the plaintext?

Clarification:

I understand that the point of using proper IV values is to prevent equivalent plaintexts from producing equivalent ciphertexts. The question is, given that an attacker knows that the same plaintext was used to generate two different ciphertexts with the same key but two different IVs, does this leak information?

  • Essentially the entire point of an IV is to make this exact operation safe. – Stephen Touset Apr 28 '15 at 21:26
  • @StephenTouset I clarified my question based on your comment. – jdmichal Apr 28 '15 at 21:46
1

The question is, given that an attacker knows that the same plaintext was used to generate two different ciphertexts with the same key but two different IVs, does this leak information?

The short answer is "no". If everything goes well, the plain-texts fed into the cipher will all be distinct, and therefore the cipher-texts will all be distinct and the attacker learns nothing. In such a scheme, you are subject however to the inherent weakness of CBC: it only takes 2^(BS/2) blocks before a collision can be expected. Thus using the same key for (a potentially arbitrary number of) different messages might not be such a great idea.

  • Thanks for the reply. So really the worry here is that constantly producing new IVs for the same message drastically increases the chance of a collision, which I assume would give up either the message or the key or both. So persisting the same IV for these objects across the session would reduce collision chances? – jdmichal Apr 29 '15 at 13:51
  • Huh? No, the weakness is general to CBC. With AES-128 you should change keys well before you reach 2^64 blocks encrypted with the same key. Keeping the same IV does not help, it is not a question of IV collisions. And such a weakness does not result in key break, just some potential plaintext leaks. – Atsby Apr 30 '15 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.