CBC IV does not in general have to be unpredictable. But my main point is that t... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

dfox on Jan 6, 2015 | parent | context | favorite | on: Secure Secure Shell

CBC IV does not in general have to be unpredictable.

But my main point is that there is no significant difference between block cipher modes in regards to requirement for IV as even CTR mode requires IV when used with repeated keys (and arguably repeated IV is more severe concern for CTR mode than for CBC) and conversely, you can just use constant IV for CBC when you can guarantee that used keys are unique.

ctz on Jan 6, 2015 [–]

> CBC IV does not in general have to be unpredictable.

Yes, it does. If not, you lose IND-CPA. That is, if it is predictable the attacker gets to test guesses for the plaintext of other blocks.

Read Duong and Rizzo, "Here come the XOR Ninjas", 2011. http://www.hpcc.ecs.soton.ac.uk/~dan/talks/bullrun/Beast.pdf

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact