8

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is predictable - it is incremented for every message, but never communicated - the attacker only knows it increases by one, but not the exact value. Can they still attack from that information alone?

Edit: I'm asking if it is ok to just increment the IV for every message given that the attacker doesn't know the initial IV

Kethan
  • 81
  • 2
  • 2
    The IV doesn't have to be secret so I'm not sure what your question is. Can you elaborate more on these attacks? – Elias Jan 29 '17 at 20:21
  • 1
    Also see: https://crypto.stackexchange.com/q/3883/23623 – SEJPM Jan 29 '17 at 20:32
  • 1
    Bit with crypto.stackexchange.com/q/3883/23623 the attacker knows the IV, while in here they only know it is the previous one incremented by one, but don't know the previous IV – Kethan Jan 29 '17 at 20:34
  • 2
    Consider messages where the first block only differs in the bit corresponding to the least significant bit of the counter in your IV. – CodesInChaos Jan 29 '17 at 21:00
  • What if use only half the block and the other half is the counter, and rando. IV – Kethan Jan 29 '17 at 21:23
  • 1
    You can simply encrypt the counter first. Then the output becomes unpredictable again. – Maarten Bodewes Jan 29 '17 at 23:35
  • 1
    @MaartenBodewes: It's worth noting that there are attacks against some scenarios where the counter is encrypted with the same key as the plaintext; see e.g. section 4 of this paper. That attack does require the adversary to choose the nonces, so it does not apply directly to this question's secret-nonce scenario, but the lesson should perhaps be taken to encrypt the nonce with a different key nevertheless. – Luis Casillas Jan 30 '17 at 02:45
  • Good point, yes, do use a different key or a better scheme. – Maarten Bodewes Jan 30 '17 at 03:05

1 Answers1

12

If a nonce $N_i$ is even, then the binary numeral for it its increment $N_{i+1} = N_i + 1$ differs from $N_i$ only in its least significant bit; and if $N_i$ is odd, its increment is even. This means we can adapt chosen-plaintext attacks against CBC with counter nonces (e.g., from section 4 of this Rogaway paper) to target your scheme. Given an block cipher $E_k$ with random secret key $k$ and block size $n$, a secret initial nonce $N_1$, and nonce generation rule $N_i = N_{i-1}+1 \mod 2^n$ known to the attacker:

  1. Ask the oracle to encrypt $0^n$ (the one-block plaintext with all zero bits), getting back $C_1 = E_k(N_1 \oplus 0^n)$.
  2. Ask the oracle to encrypt $0^{n-1}1$ (the one-block plaintext with all zero bits except for the least significant), getting back $C_2 = E_k(N_2 \oplus 0^{n-1}1)$.
  3. Ask the oracle to encrypt $0^n$ again, getting back $C_3 = E_k(N_3 \oplus 0^n)$.
  4. If either $C_1 = C_2$ or $C_2 = C_3$, the attacker knows with high probability they're talking to an encryption oracle. Otherwise the attacker knows they're talking to a random oracle.

Proof. If $N_1$ is even, then its least sigificant bit is $0$, meaning that $N_2 = N_1 \oplus 0^{n-1}1$, and then, given that $C_2 = E_k(N_2 \oplus 0^{n-1}1)$:

$$ \begin{align} C_2 &= E_k(N_1 \oplus 0^{n-1}1 \oplus 0^{n-1}1) \\ C_2 &= E_k(N_1) \\ C_2 &= E_k(N_1 \oplus 0^n) \\ C_2 &= C_1 \end{align} $$

If $N_1$ is odd, its least sigificant bit is $1$, $N_2$'s is $0$, and $N_3$ differs from $N_2$ only in its LSB: $N_3 = N_2 \oplus 0^{n-1}1$. So given that $C_3 = E_k(N_3 \oplus 0^n)$:

$$ \begin{align} C_3 &= E_k(N_2 \oplus 0^{n-1}1 \oplus 0^n) \\ C_3 &= E_k(N_2 \oplus 0^{n-1}1) \\ C_3 &= C_2 \\ \end{align} $$

Luis Casillas
  • 14,468
  • 2
  • 31
  • 53