Initialization Vector - Properties

Properties

Properties of an IV depend on the cryptographic scheme used. A basic requirement is uniqueness, which means that no IV may be reused under the same key. For block ciphers, repeated IV values devolve the encryption scheme into electronic codebook mode: equal IV and equal plaintext result in equal ciphertext. In stream cipher encryption uniqueness is crucially important as plaintext may be trivially recovered otherwise.

Example: Stream ciphers encrypt plaintext P to ciphertext C by deriving a key stream K from a given key and IV and computing C as C = P xor K. Assume that an attacker has observed two messages C₁ and C₂ both encrypted with the same key and IV. Then knowledge of either P₁ or P₂ reveals the other plaintext since

C₁ xor C₂ = (P₁ xor K) xor (P₂ xor K) = P₁ xor P₂.

Many schemes require the IV to be unpredictable by an adversary. This is effected by selecting the IV at random or pseudo-randomly. In such schemes, the chance of a duplicate IV is negligible, but the effect of the birthday problem must be considered. As for the uniqueness requirement, a predictable IV may allow recovery of (partial) plaintext.

Example: Consider a scenario where a legitimate party called Alice encrypts messages using the cipher-block chaining mode. Consider further that there is an adversary called Eve that can observe these encryptions and is able to forward plaintext messages to Alice for encryption (in other words, Eve is capable of a chosen-plaintext attack). Now assume that Alice has sent a message consisting of an initialization vector IV₁ and starting with a ciphertext block C_Alice. Let further P_Alice denote the first plaintext block of Alice's message, let E denote encryption, and let P_Eve be Eve's guess for the first plaintext block. Now, if Eve can determine the initialization vector IV₂ of the next message she will be able to test her guess by forwarding a plaintext message to Alice starting with (IV₂ xor IV₁ xor P_Eve)); if her guess was correct this plaintext block will get encrypted to C_Alice by Alice. This is because of the following simple observation:

C_Alice = E(IV₁ xor P_Alice) = E(IV₂ xor (IV₂ xor IV₁ xor P_Alice)).

Depending on whether the IV for a cryptographic scheme must be random or only unique the scheme is either called randomized or stateful. While randomized schemes always require the IV chosen by a sender to be forwarded to receivers, stateful schemes allow sender and receiver to share a common IV state, which is updated in a predefined way at both sides.