Encryption using a nonstandard-IV

Question

So i got a few xml files that need to be encrypted and it works, no problems here. Now since the latest update of the CodeAnalyzers i got a new warning ( CA5401 ) that tells me, that it is a bad idea to have a "nonstandard initializing vector". A little research showed me, why it is indeed a good idea to have a new IV each time a message is encoded. I shall use random IVs, it says.

However, i still need the exact same IV to decode that file, so using a newly generated IV to open a file from last friday won't work.

However then i saw this: https://www.codeproject.com/Articles/556454/Encrypt-and-Decrypt-Text-with-a-Specified-Key

Where basically the IV is used as the first bytes of each encryted text and thus, an unencrypted part of the data.

Is this how it is meant to be done?

Answer 1

The IV is not a secret key, but is analogous to the salt in a hash function. Every message must have a unique IV so that the same plaintext generates a different ciphertext. If we have two messages m1, m2 and reuse the IV, and the ciphertexts Encrypt(IV + m1, key) = Encrypt(IV + m2, key) are identical, we know just from looking at the ciphertext that m1 = m2. This can leak information about the contents, or even defeat the encryption in a chosen-plaintext attack. In a block cipher, the ciphertext blocks would be identical up to the first differing plaintext block, thus potentially allowing an attacker to figure out the prefix – very dangerous.

Thus, every time you encrypt a message, you must choose a new IV. Depending on the encryption algorithm this can be a simple counter, or must have stronger randomness guarantees. (Of course, using a simple counter would leak information about the number of encryption operations…). As the IV/salt is not secret, prepending it to the ciphertext is safe. Preferably, use the built-in mechanisms of your crypto libraries to generate IVs.