Lecture
In cryptography, an initialisation vector ( IV ) or starting variable ( SV ) is an input to a cryptographic primitive used to establish an initial state. An IV is usually required to be random or pseudorandom, but sometimes it only needs to be unpredictable or unique. Randomisation is critical for some encryption schemes to achieve semantic security, a property whereby reusing the scheme under the same key does not let an attacker infer any relationship between (potentially similar) segments of the encrypted message. For block ciphers, the use of an IV is described by the modes of operation.
Some cryptographic primitives require the IV to be non-repeating, with the required randomness determined internally. In this case the IV is usually called a nonce ( number used once ), and the primitives (for example, CBC) are considered stateful, rather than randomised . This is because the IV does not need to be explicitly sent to the recipient but can instead be derived from a shared state updated on both the sender's and the recipient's side. (In practice, a short nonce is still transmitted along with the message to allow for message loss.) An example of a stateful encryption scheme is counter mode, which uses a sequence number as the nonce.
The size of the IV depends on the cryptographic primitive used; for block ciphers it is usually the block size of the cipher. In encryption schemes, the unpredictable part of the IV is at best the same size as the key, in order to offset time/memory/data trade-off attacks. When the IV is chosen at random, the probability of collisions arising from the birthday problem must be taken into account. Traditional stream ciphers such as RC4 do not support an explicit IV as an input, so a special solution is needed to fold the IV into the cipher key or into the internal state. Some designs implemented in practice are known to be insecure; the WEP protocol is a striking example and is vulnerable to related-IV attacks.
In CBC mode, identical plaintext blocks are encrypted into different ciphertext blocks only if some of the preceding plaintext blocks differed. Two identical messages, however, will be encrypted into the same ciphertext. Worse still, two messages with the same beginning will be encrypted identically up to the point of their first difference.
A number of messages may share the same header — the subject line, the "From'' field, or something else. Although a repeated block will be impossible, such an identical beginning can still give a cryptanalyst some useful information.
This can be avoided by encrypting some random data as the first block. This block of random data is called the initialization vector (IV), the initializing variable, or the initial chaining value. The IV carries no semantic meaning; it is used only to make each message unique. When the recipient decrypts this block, it uses it only to fill the feedback register. A good IV is a timestamp. Or use some random bits.
With the use of an IV, messages with identical plaintext are encrypted into messages with different ciphertext. As a result, an attacker cannot mount a block-replay attack, and building a codebook becomes harder. Although it is recommended to choose a unique IV for every message encrypted under the same key, this requirement is not mandatory.
The IV does not need to be kept secret; it can be transmitted openly along with the ciphertext. If you don't see why, consider the following argument. Suppose our message consists of several blocks: B1, B2, ..., Bi. B1 is encrypted together with the IV. B2 is encrypted using the ciphertext of B1 as the IV. B3 is encrypted using the ciphertext of B2 as the IV, and so on. So if the number of blocks is n, then n-1 "initialization vectors" are exposed, even though the original IV is kept secret. Therefore there is no reason to keep the IV secret; the IV is just a dummy block, and can be regarded as a zero chaining block B0.
A block cipher is one of the most fundamental primitives in cryptography and is often used for data encryption. By itself, however, it can only be used to encode a block of data of a predetermined size, called the block size. For example, a single call to the AES algorithm transforms a 128-bit plaintext block into a 128-bit ciphertext block. The key, which is supplied as a single input to the cipher, determines the mapping between plaintext and ciphertext. If data of arbitrary length needs to be encrypted, a simple strategy is to split the data into blocks each matching the cipher's block size and encrypt each block separately using the same key. This method is insecure, because equal plaintext blocks are transformed into equal ciphertexts, and a third party observing the encrypted data can easily determine its content even without knowing the encryption key.
To hide patterns in the encrypted data, without having to issue a new key after every call to the block cipher, a method for randomizing the input is needed. In 1980, NIST published a national standard document called Federal Information Processing Standard (FIPS) PUB 81, which defined four so-called modes of operation for a block cipher, each describing a different solution for encrypting a set of input blocks. The first mode implements the simple strategy described above and was defined as the electronic codebook (ECB) mode. In contrast, each of the other modes describes a process in which the ciphertext from one block-cipher step is mixed with the data from the next encryption step. To start this process, an additional input value must be mixed with the first block, called the initialization vector . For example, the cipher block chaining (CBC) mode requires an unpredictable value the size of the cipher's block size as additional input. This unpredictable value is added to the first plaintext block before it is encrypted. In turn, the ciphertext produced at the first encryption step is added to the second plaintext block, and so on. The ultimate goal of encryption schemes is to achieve semantic security: thanks to this property, an attacker can practically extract no information from the observed ciphertext. It can be shown that each of the three additional modes defined by NIST is semantically secure under so-called chosen-plaintext attacks.
The properties of an IV depend on the cryptographic scheme used. The main requirement is uniqueness , meaning an IV must not be reused under the same key. For block ciphers, repeated IV values turn the encryption scheme into electronic codebook mode: an equal IV and equal plaintext produce identical ciphertext. In stream cipher encryption, uniqueness is critical, since otherwise the plaintext can easily be recovered.
Example: stream ciphers encrypt plaintext P into ciphertext C by deriving the keystream K from a given key and IV, computing C as C = P xor K . Suppose an attacker discovers two messages C 1 and C 2, encrypted under the same key and IV. Then knowledge of P 1 or P 2 reveals the other plaintext, since
C 1 xor C 2 = ( P 1 xor K) xor ( P 2 xor K) = P 1 xor P 2 .
Many schemes require the IV to be unpredictable by an adversary. This is achieved by choosing the IV randomly or pseudorandomly. In such schemes, the chance of an IV collision is negligible, but the effect of the birthday problem must be taken into account. As for the uniqueness requirement, a predictable IV may allow recovery of (part of) the plaintext.
Example: consider a scenario in which a legitimate party named Alice encrypts messages using cipher block chaining mode. Further consider that there is an adversary named Eve, who can observe this encryption and can forward plaintext messages to Alice for encryption (in other words, Eve is capable of a chosen-plaintext attack). Now suppose Alice sent a message consisting of the initialization vector IV 1 and beginning with a block of ciphertext C Alice . Let P Alice further denote the first plaintext block of Alice's message, let E denote encryption, and let P Eve denote Eve's guess for the first plaintext block. Now, if Eve can determine the initialization vector IV 2 of the next message, she can verify her guess by sending Alice a plaintext message beginning with ( IV 2 xor IV 1 xor P Eve ); if her guess was correct, this plaintext block will be encrypted by Alice into C Alice. This follows from the following simple observation:
C Alice = E ( IV 1 xor P Alice ) = E ( IV 2 xor ( IV 2 xor IV 1 xor P Alice )).
Depending on whether the IV for a cryptographic scheme must be random or only unique, the scheme is called either randomized, or with state retention . While randomized schemes always require the IV chosen by the sender to be forwarded to the recipients, stateful schemes allow the sender and recipient to share a common IV state that is updated in a predetermined way on both sides.
Processing of data by a block cipher is usually described as a mode of operation. Modes are primarily defined for encryption, and also for authentication, although newer constructions exist that combine both security solutions in so-called authenticated encryption modes. While encryption and authenticated encryption modes usually use an IV matching the cipher's block size, authentication modes are typically implemented as deterministic algorithms, with the IV set to zero or some other fixed value.
In stream ciphers, the IV is loaded into the cipher's internal secret state together with the key, after which a number of encryption rounds are run before the first output bit is released. For performance reasons, stream cipher designers try to keep this number of rounds as small as possible; however, since determining the minimum safe number of rounds for stream ciphers is not a trivial task, and given other issues — such as entropy loss — unique to each construction, related-IV constructions and other IV-related attacks are a well-known security problem for stream ciphers, which makes IV loading in stream ciphers a serious challenge and a subject of ongoing research.
The 802.11 encryption algorithm called WEP (short for Wired Equivalent Privacy) uses a short, 24-bit IV, which results in IV reuse under the same key, making it easy to break. Packet injection made it possible to crack WEP within seconds. This ultimately led to WEP being deprecated.
In cipher block chaining mode (CBC mode) the IV does not need to be secret, but it must be unpredictable (specifically, for any given plaintext it must not be possible to predict the IV that will be associated with the plaintext before the IV is generated) during encryption. In addition, for OFB mode the IV must be unique. In particular, the (formerly) common practice of reusing the last ciphertext block of a message as the IV for the next message is insecure (for example, this method was used by SSL 2.0). If an attacker knows the IV (or the previous ciphertext block) before specifying the next plaintext, they can verify their guess about the plaintext of some block that was previously encrypted under the same key. This is known as the TLS CBC IV attack, also called the BEAST attack
Comments