Re:AES on the iPhone is Broken by Default
by tptacek on Wednesday December 14, 2011 @11:05AM
(#3352315)
It's a significant issue. For instance, Thai Duong and Juliano Rizzo's recent SSL decrypting attack relied on predicting (not controlling) IVs --- in other words, literally the attack this thread is talking about, but under more constraints.
It is not a "really big issue" in the sense of "we forgot to put a MAC on this ciphertext to guarantee authenticity", which is a more common mistake than not setting an IV; or, a "really big issue" in the sense of "we managed to expose a padding oracle", which is a more common CBC mistake. But it is a significant mistake.
How you choose to key streams is an orthogonal concern to whether your block cipher mode leaks data.
It is not a "really big issue" in the sense of "we forgot to put a MAC on this ciphertext to guarantee authenticity", which is a more common mistake than not setting an IV; or, a "really big issue" in the sense of "we managed to expose a padding oracle", which is a more common CBC mistake. But it is a significant mistake.
How you choose to key streams is an orthogonal concern to whether your block cipher mode leaks data.