Re:AES on the iPhone is Broken by Default
by tptacek on Wednesday December 14, 2011 @11:05AM
(#3352315)
It's a significant issue. For instance, Thai Duong and Juliano Rizzo's recent SSL decrypting attack relied on predicting (not controlling) IVs --- in other words, literally the attack this thread is talking about, but under more constraints.
It is not a "really big issue" in the sense of "we forgot to put a MAC on this ciphertext to guarantee authenticity", which is a more common mistake than not setting an IV; or, a "really big issue" in the sense of "we managed to expose a padding oracle", which is a more common CBC mistake. But it is a significant mistake.
How you choose to key streams is an orthogonal concern to whether your block cipher mode leaks data.
Re:AES on the iPhone is Broken by Default
by JoachimSchipper on Wednesday December 14, 2011 @11:07AM
(#3352321)
The point of using an IV is that you can use the same key for multiple messages. You're not supposed to repeat (key, nonce) pairs for a stream cipher, and CBC's IV is sort-of equivalent to the nonce. (AES-CBC is not technically a stream cipher. Not all stream ciphers have nonces.)
Re:AES on the iPhone is Broken by Default
by tptacek on Wednesday December 14, 2011 @11:28AM
(#3352406)
Using the same key+nonce pair in a stream cipher has the effect of generating an identical keystream. It's a much, much worse problem than repeating IVs; it makes decrypting the resulting ciphertext stream almost a pencil/paper exercise.
Sorry for the pedantry.
In CBC (with known IV) you only get the same ciphertext for identical blocks in the beginning of different transmissions if you use the same key for both transmissions. As you're not supposed to use the same key twice for a stream cipher, it's not a really big issue.