Theo de Raadt summarizes the OpenBSD IPSec "backdoor" situation

Re:Theo de Raadt summarizes the OpenBSD IPSec "backdoor" sit... by antirez on Wednesday December 22, 2010 @03:11AM (#2030868)

> Here's the thing about the IV: it's conceptually

> ciphertext. It's a public value. Anybody can see it.

> The only thing it's not supposed to be is predictable

> or repeatable.

You don't need the IV to be non predictable, as long as it is a different string every time it's all ok. The outcome of the encryption is also related to the first block of real plaintext, so your IV can just be a few random bytes with a decent distribution: no need for a cryptographically secure random number generator.

[ Parent | on HN ]

Re:Theo de Raadt summarizes the OpenBSD IPSec "backdoor" sit... by tptacek on Wednesday December 22, 2010 @09:47AM (#2031418)

No, it helps you not-at-all that the IV hasn't been repeated; again: the attack is, "knowing what I know about the IV you're going to use to encrypt a plaintext I feed you, I'm going to feed you a plaintext that cancels out two IVs so I can use you as an oracle for any ciphertext block".

Also, answer my email! =)

[ Parent | on HN ]

Re:Theo de Raadt summarizes the OpenBSD IPSec "backdoor" sit... by almost on Wednesday December 22, 2010 @07:19AM (#2031128)

I'm confused, didn't the parent comment just explain why it MUST be unpredictable? Doesn't the attack tptacek describes use the fact that the IV is predictable?

[ Parent | on HN ]