Applied Cryptography
Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?
- AKeep the IV secret like the key and keep using the same value for every message
- BThe IV need not be secret, but choose a new random value for each message that an attacker cannot predict
- CThe IV need not be secret, and it may be fixed to the same value agreed with the other party (for example all zeros) every time
Show answer and explanation
Answer: B. The IV need not be secret, but choose a new random value for each message that an attacker cannot predict
In CBC mode each plaintext block is XORed with the previous ciphertext block before being encrypted, and the first block is XORed with the IV. The IV is usually sent at the beginning of the ciphertext, so it need not be kept secret. However, if the same IV is used every time, messages that begin the same way also produce ciphertexts that begin the same way, revealing that parts of the contents are identical. Furthermore, if an attacker can predict the next IV, attacks are known that guess contents by having chosen plaintexts encrypted (such as the BEAST attack on TLS 1.0).
- A. The IV is normally sent together with the ciphertext and need not be secret. Reusing the same value lets messages that begin the same way be recognized.
- B. Correct. The IV in CBC mode is an unpredictable value for each message.
- C. With a fixed IV the same plaintext always gives the same ciphertext, creating a weakness close to that of ECB mode.