The importance of IVs

From: mobius30 (mobius30_at_hushmail.com)
Date: 08/27/05 

Date: 27 Aug 2005 10:38:16 -0700

Recently I looked around on then internet for freeware plain-text
encryption programs. There are a handful of them out there that
support most of the popular encryption methods. One of them, it will
go un-named for now, uses CBC/MD5/RijndaelAES to allow users to quickly
and easily encrypt and decrypt plain-text. Upon further examination, I
noticed this particular application does not apply any IV prior to
encryption of the selected text. I was surprised to find how many of
these freeware applications don't. Why is that? I would think
implementing something as simple as random data into the first block(s)
of text would be SOP for anyone writing one of these applications.
Considering that many users of these applications might be encrypting
text with repetitive headers (i.e. "Dear Sally", etc.), I would think
the authors of the applications would implement at least an IV for the
first block. Below, I've listed some clear text and the resulting
CBC/MD5/AES cipher-text from the password "test" (no quotes). As you
can see, without the random data at the beginning of the message, the
encrypted messages all start out identically.
My questions:

How important are IVs? Does not using them really pose that much of a
risk under the conditions that:
a) you have several repetitive characters at the beginning of multiple
intercepted encrypted messages
b) the same password is used in each of these messages (let's say it's
64-bits)

What's the point of using a relatively good system (like CBC/MD5/AES)
and not randomizing the first block(s)??? How much easier would it be
to crack? How many intercepted messages (average love-letter length)
would someone need to crack this and how long would it take assuming
reasonable PC computing power?

TEST CASES:
________________________________________
[ NO IV USED (notice the repeating encrypted text at the beginning) ]

This is a test.
lIbEhACsdJyAb0oIcC+3CHBXwFKg

This is a test. Test. Test.
lIbEhACsdJyAb0oIcC+3CPVuU16EczTruQ==

This is a test. One. One.
lIbEhACsdJyAb0oIcC+3CHWB6wOMDZ2O0gpu

This is a test. Two. Two.
lIbEhACsdJyAb0oIcC+3CPXupSuMzVbnuX+fYmk=

This is a test. Three. Three.
lIbEhACsdJyAb0oIcC+3CPXu2/VQWIXnuZF9Y5I=

_________________________________________
[ WITH IV (no repeats or patterns immediately noticeable) ]

d89s This is a test.
6HWpWqhD50pfsJgmcwOiHk8p5HjIpZLkehQ=

cl;2 This is a test.
SA5koEpZGQNZI+j+tNueKQH5ZKgJLr9dWeo=
_________________________________________

Relevant Pages

  • Re: Determining the encryption used
    ... The problem with trying to determine the encryption used is due to the fact ... applications continue to rise, you need to proactively protect your ... managed service or an enterprise software ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)
  • Re: how to recover encrypted files due to a system crash
    ... But when I opened them with their own applications, ... The main solution is to import the account certificates that XP didn't require you to export when you first invoked encryption. ... The alternative solution is to use the Recovery Agent system that didn't have to be specified either. ... They didn't do anywhere near as good a job at making sure average users were protected from or even aware of its implications and the shortcomings of their model. ...
    (microsoft.public.windowsxp.general)
  • Re: Crypto question
    ... >by individual applications. ... >times with the certificates from the n applications. ... >application (for which encryption has been done) then needs to be able ... >digital signatures can be applied, but that scenario doesn't work, as ...
    (sci.crypt)
  • Re: Loss of computer - how much does the password protect?
    ... I use an encryption application called TrueCrypt, you can get it at truecrypt.org. ... From the True Crypt web site, it has the following features: ... Creates a virtual encrypted disk within a file and mounts it as a real disk. ... First, I created an encrypted virtual volume, and for the applications that have personal data I don't want compromised, I create directories in the virtual volume and edit the application preferences to store my data into these folders. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: WARNING: Some "AES" USB drives actually using easy-to-crack XOR
    ... which are entirely filled with random data, ... So then you're claiming Truecrypt hidden containers are "laughable ... that many people make simple mistakes with encryption. ... Nemo, by sheer power of his arrogance and anal retentiveness, has ...
    (alt.privacy)
Quantcast