38

In AES, my understanding is that salt is the stuff to make the passphrase more secure and it wont be added into encrypted text. But IV is the stuff used to encrypt the first block of message and will be added into the encrypted text.

Do I get anything wrong?

Muhammad Nabeel Arif
  • 19,140
  • 8
  • 51
  • 70
Kelvin
  • 1,103
  • 2
  • 11
  • 16

4 Answers4

51

AES itself does not directly use a salt (or indeed, an IV).

A situation when you might use a salt in combination with AES is when you are using Password Based Encryption (PBE). In this scheme, a human-memorizable password is used, in combination with a salt, to generate an AES key. A salt is used so that the same password does not always generate the same key; however, because the recipient must be able to generate the correct key, the salt must be transmitted along with the encrypted data.

An IV is required if you are using AES in certain block cipher modes, like CBC. In this case, it used to ensure that the same plaintext data under the same key does not always encrypt to the same ciphertext. Again, the IV is required by the recipient to correctly decrypt the data, so it must be transmitted along with the encrypted data.

So, if you are using PBE with AES in CBC mode as the underlying cipher, you would expect to have to send both a PBE salt and a CBC IV along with the encrypted data.

caf
  • 233,326
  • 40
  • 323
  • 462
  • 3
    If bothe salt and IV sent with encrypted data, what's the point to have them? Cause attacker can get salt and IV easily from the data, then the only job is to get passphrase, which isnt the same as the method without salt and IV? – Kelvin Dec 23 '09 at 22:16
  • 23
    Read my response carefully again. The salt is used **so that the same password does not always generate the same key** - this means, among other things, that an attacker cannot offline build a dictionary of passwords-to-keys. An IV similarly ensures that the **same plaintext does not produce the same ciphertext** - this means that an attacker can't build up a set of cribs. These do not *stop* bruteforce attacks (you cannot do that) - but they maximise the time/memory required for a bruteforce attack, and effectively prevent some precomputations. – caf Dec 23 '09 at 22:27
  • 1
    Thank you for ur quick response. My understanding is a cryption without salt and IV will be something like equation f(data) = x(passphrase) And the one with salt and IV will be f(data) = x + y(salt) + z(IV) You get y and z, then the 2nd equation will be the same as 1st one. Anything I misunderstood here? – Kelvin Dec 23 '09 at 22:47
  • 3
    Yes, what you've misunderstood is that the second equation is actually `X'(data, passphrase, salt, IV)` - the effect of the salt and IV can't be factored out separately. – caf Dec 23 '09 at 23:04
  • BTW, some ppl mentioned IV could be public but salt must be kept in secure. How could you transmit salt with ciphertext then? Cause transmitting it with cipertext will make it public? – Kelvin Dec 23 '09 at 23:50
  • 1
    The salt under PBE does not need to be kept secure (and can't be, because the legitimate recipient needs it to be able to reconstruct the key). Just make sure you pick the salt randomly, and pick a new one each time you start a new encryption session. – caf Dec 23 '09 at 23:59
  • 8
    Isn't having the salt and the IV redundant? If I have PBE in AES CBC mode and I always use the same IV, but I use randomly generated salt at all times, isn't it enough? The resulting ciphers will all be unique, because never will I encrypt the same plaintext twice. What am I missing here? – Didier A. Aug 29 '13 at 18:35
  • What @DidierA. commented is what I am trying to confirm. The reverse also seems true. If I have a random IV each time, but the same salt (or no salt), isn't that enough? Wouldn't that always result in a different ciphertext and thus always end up with a unique result even if the same unsalted password is used each time? Is this really redundant or is there a benefit to always having both a random salt and a random IV? – OCDev Oct 13 '22 at 11:22
  • @OCDev: The two different primitives have generally been analysed separately, so we know the security behaviour of PBE with a random salt, and we know the security behaviour of CBC with a random IV. Once you depart from that and start creating novel cryptosystems like *"PBE with fixed salt, combined with CBC using a random IV"* or *"PBE with a random salt combined with CBC using a fixed IV"*, we don't necessarily know the security properties of that and it would call for serious analysis if you're going to rely on it. – caf Oct 17 '22 at 02:25
  • @OCDev: I can't see anything immediately obvious, but it's more brittle and the devil is often in the details. The first variation (fixed salt in the PBE) is particularly iffy because you might well want to use the derived key for other things, like a MAC. And what's the advantage, you save 16 bytes in your message? – caf Oct 17 '22 at 02:26
15

I don't quite follow what you are saying, but here is an overview.

Salts are used in cryptographic hashing in order to eliminate the possibility of success using rainbow table method of cracking. (A rainbow table being a reverse lookup table of hashes to passwords)

IVs are used in encryption of larger files to avoid similar sections from encrypting to the same thing.

They are extremely similar, but here are the differences.

Salts are typically added before or after what they are encrypting (to my knowledge). This means that the encryption is also performed on the salt.

IVs are always XORed with the result of the encryption. The reason it is done afterwards, is because only the first chunk uses the IV, the rest use the previous chunk for this XORing.

The distinction is important because a salt that is XORed with the encrypted form of a password is easily broken, and IVs are designed to stop pattern recognition style attacks versus the dictionary attacks of password files.

Philippe Delteil
  • 937
  • 13
  • 30
Guvante
  • 18,775
  • 1
  • 33
  • 64
4

No. The IV prevents otherwise-identical messages from appearing the same. This would leak information, specifically, the fact that you're transmitting the same message more than once.

Peter
  • 127,331
  • 53
  • 180
  • 211
  • 5
    2 different IVs on the same plaintext will produces 2 different ciphers, just like 2 different salts would do too. I don't think you did answer the question quite well. – Murmel Aug 31 '16 at 12:48
1

To add to @Guvante answer, IV is specifically used with CBC mode (Cipher Block Chaining mode) and it adds more security compared to the EBC mode (where if two identical blocks encrypted with the same key they produce the same cipher), IV fixes that.

Salting is more of a hashing term, used to fight against rainbow attacks, it doesn't make hacking impossible but makes discovering patterns between identical passwords infeasible, so the same plaintext password doesn't produce the same hash. They are pretty similar, but it's important to understand the use and implementation of each one.

mshwf
  • 7,009
  • 12
  • 59
  • 133