Incryptography, aninitialization vector (IV) orstarting variable[1] is an input to acryptographic primitive being used to provide the initial state. The IV is typically required to berandom orpseudorandom, but sometimes an IV only needs to be unpredictable or unique.Randomization is crucial for someencryption schemes to achievesemantic security, a property whereby repeated usage of the scheme under the samekey does not allow an attacker to infer relationships between (potentially similar) segments of the encrypted message. Forblock ciphers, the use of an IV is described by themodes of operation.
Some cryptographic primitives require the IV only to be non-repeating, and the required randomness is derived internally. In this case, the IV is commonly called anonce (a number used only once), and the primitives (e.g.CBC) are consideredstateful rather thanrandomized. This is because an IV need not be explicitly forwarded to a recipient but may be derived from a common state updated at both sender and receiver side. (In practice, a short nonce is still transmitted along with the message to consider message loss.) An example of stateful encryption schemes is thecounter mode of operation, which has asequence number for a nonce.
The IV size depends on the cryptographic primitive used; for block ciphers it is generally the cipher's block-size. In encryption schemes, the unpredictable part of the IV has at best the same size as the key to compensate for time/memory/data tradeoff attacks.[2][3][4][5] When the IV is chosen at random, the probability of collisions due to thebirthday problem must be taken into account. Traditional stream ciphers such asRC4 do not support an explicit IV as input, and a custom solution for incorporating an IV into the cipher's key or internal state is needed. Some designs realized in practice are known to be insecure; theWEP protocol is a notable example, and is prone to related-IV attacks.
Ablock cipher is one of the most basicprimitives in cryptography, and frequently used for dataencryption. However, by itself, it can only be used to encode a data block of a predefined size, called theblock size. For example, a single invocation of theAES algorithm transforms a 128-bitplaintext block into aciphertext block of 128 bits in size. Thekey, which is given as one input to the cipher, defines the mapping between plaintext and ciphertext. If data of arbitrary length is to be encrypted, a simple strategy is to split the data into blocks each matching the cipher's block size, and encrypt each block separately using the same key. This method is not secure as equal plaintext blocks get transformed into equal ciphertexts, and a third party observing the encrypted data may easily determine its content even when not knowing the encryption key.
To hide patterns in encrypted data while avoiding the re-issuing of a new key after each block cipher invocation, a method is needed torandomize the input data. In 1980, theNIST published a national standard document designatedFederal Information Processing Standard (FIPS) PUB 81, which specified four so-calledblock cipher modes of operation, each describing a different solution for encrypting a set of input blocks. The first mode implements the simple strategy described above, and was specified as theelectronic codebook (ECB) mode. In contrast, each of the other modes describe a process where ciphertext from one block encryption step gets intermixed with the data from the next encryption step. To initiate this process, an additional input value is required to be mixed with the first block, and which is referred to as aninitialization vector. For example, thecipher-block chaining (CBC) mode requires an unpredictable value, of size equal to the cipher's block size, as additional input. This unpredictable value is added to the first plaintext block before subsequent encryption. In turn, the ciphertext produced in the first encryption step is added to the second plaintext block, and so on. The ultimate goal for encryption schemes is to providesemantic security: by this property, it is practically impossible for an attacker to draw any knowledge from observed ciphertext. It can be shown that each of the three additional modes specified by the NIST are semantically secure under so-calledchosen-plaintext attacks.
Properties of an IV depend on the cryptographic scheme used. A basic requirement isuniqueness, which means that no IV may be reused under the same key. For block ciphers, repeated IV values devolve the encryption scheme into electronic codebook mode: equal IV and equal plaintext result in equal ciphertext. Instream cipher encryption uniqueness is crucially important as plaintext may be trivially recovered otherwise.
Many schemes require the IV to beunpredictable by anadversary. This is effected by selecting the IV atrandom orpseudo-randomly. In such schemes, the chance of a duplicate IV isnegligible, but the effect of thebirthday problem must be considered. As for the uniqueness requirement, a predictable IV may allow recovery of (partial) plaintext.
Depending on whether the IV for a cryptographic scheme must be random or only unique the scheme is either calledrandomized orstateful. While randomized schemes always require the IV chosen by a sender to be forwarded to receivers, stateful schemes allow sender and receiver to share a common IV state, which is updated in a predefined way at both sides.
Block cipher processing of data is usually described as a mode of operation. Modes are primarily defined for encryption as well asauthentication, though newer designs exist that combine both security solutions in so-calledauthenticated encryption modes. While encryption and authenticated encryption modes usually take an IV matching the cipher's block size, authentication modes are commonly realized asdeterministic algorithms, and the IV is set to zero or some other fixed value.
In stream ciphers, IVs are loaded into the keyed internal secret state of the cipher, after which a number of cipher rounds are executed prior to releasing the first bit of output. For performance reasons, designers of stream ciphers try to keep that number of rounds as small as possible, but because determining the minimal secure number of rounds for stream ciphers is not a trivial task, and considering other issues such asentropy loss, unique to each cipher construction, related-IVs and other IV-related attacks are a known security issue for stream ciphers, which makes IV loading in stream ciphers a serious concern and a subject of ongoing research.
The802.11encryptionalgorithm called WEP (short forWired Equivalent Privacy) used a short, 24-bit IV, leading to reused IVs with the same key, which led to it being easily cracked.[7]Packet injection allowed for WEP to be cracked in times as short as several seconds. This ultimately led to the deprecation of WEP.
Incipher-block chaining mode (CBC mode), the IV need not be secret, but must be unpredictable (In particular, for any given plaintext, it must not be possible to predict the IV that will be associated to the plaintext in advance of the generation of the IV.) at encryption time. Additionally for theoutput feedback mode (OFB mode), the IV must be unique.[8] In particular, the (previously) common practice of re-using the last ciphertext block of a message as the IV for the next message is insecure (for example, this method was used by SSL 2.0). If an attacker knows the IV (or the previous block of ciphertext) before he specifies the next plaintext, he can check his guess about plaintext of some block that was encrypted with the same key before. This is known as the TLS CBC IV attack, also called theBEAST attack.[9]
