So i got a few xml files that need to be encrypted and it works, no problems here. Now since the latest update of the CodeAnalyzers i got a new warning ( CA5401 ) that tells me, that it is a bad idea to have a "nonstandard initializing vector". A little research showed me, why it is indeed a good idea to have a new IV each time a message is encoded. I shall use random IVs, it says.

However, i still need the exact same IV to decode that file, so using a newly generated IV to open a file from last friday won't work.

However then i saw this: https://www.codeproject.com/Articles/556454/Encrypt-and-Decrypt-Text-with-a-Specified-Key

Where basically the IV is used as the first bytes of each encryted text and thus, an unencrypted part of the data.

Is this how it is meant to be done?

  • 1
    You need a mechanism to calculate the IV on both sides the same way on the same timing. Something along the lines of a token generator some sites use for additional security. Of course, if you need to re-open something stored with this type of encryption, you also have to store enough metadata to recalculate the IV for that file. – Berin Loritsch Mar 30 at 14:51
  • 2
    The question of course is why traditional means of encrypting data is not going to work. I.e. is this file being sent via normal web channels (HTTP or HTTPS)?, being sent asynchronously, etc. – Berin Loritsch Mar 30 at 14:53

The IV is not a secret key, but is analogous to the salt in a hash function. Every message must have a unique IV so that the same plaintext generates a different ciphertext. If we have two messages m1, m2 and reuse the IV, and the ciphertexts Encrypt(IV + m1, key) = Encrypt(IV + m2, key) are identical, we know just from looking at the ciphertext that m1 = m2. This can leak information about the contents, or even defeat the encryption in a chosen-plaintext attack. In a block cipher, the ciphertext blocks would be identical up to the first differing plaintext block, thus potentially allowing an attacker to figure out the prefix – very dangerous.

Thus, every time you encrypt a message, you must choose a new IV. Depending on the encryption algorithm this can be a simple counter, or must have stronger randomness guarantees. (Of course, using a simple counter would leak information about the number of encryption operations…). As the IV/salt is not secret, prepending it to the ciphertext is safe. Preferably, use the built-in mechanisms of your crypto libraries to generate IVs.

| improve this answer | |
  • That was a very clear and easy to understand answer. Thank you! – Otterprinz Mar 30 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.