Re:AES on the iPhone is Broken by Default
by tptacek on Wednesday December 14, 2011 @10:52AM
(#3352260)
The article had a linkbait title, to be sure.
It is a significant problem to have deployed CBC with predictable IVs (all zeroes is no worse than any other predictable IV), for the very same reason it's bad to use ECB mode.
The IV does not need to be secret, but an attacker shouldn't be able to predict what the IV for a given piece of plaintext will be before it's encrypted. If that makes sense.
I don't know how using a block cipher in cipher block chaining (CBC) would be different here. In the article, OP suggests that it may be related to short messages. Indeed, if the plaintext is less than or equal to one block, and you re-use the same key (which you should never do) it's possible to do replay attacks.
If anyone has deeper knowledge of cryptography and block cipher modes in particular, please explain to us how CBC is vulnerable if the IV is known by the attacker? Why are short messages more vulnerable and to which attack modes?
As I said, I'm not a cryptographer, only a uni student with an exam on crypto tomorrow. To me, it seems like the article had a linkbait title and it didn't describe a very big threat anyway (and it was only superficially related to AES). But if crypto class has taught me anything, it's that intuition often fails. So don't take my word for it, there may be a real threat behind this.