[lkml]   [2000]   [Oct]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: A patch to loop.c for better cryption support
kernel  wrote:
>There are some who believe that "not unique" IVs (across multiple
>filesystems) facilitates some methods of cryptanalysis.

It's a not a matter of "belief"; it's a matter of fact.
The weakness is that the first block of ciphertext depends
only on the IV and the first block of plaintext.

Thus, if the IV is the same for two sectors, then you can
tell from the two ciphertexts whether the two plaintexts
start with the same 8-byte (or 16-byte) prefix. Since what
we're encrypting is often patterned, and thus repeats in
the beginning of the plaintext may be semi-common, this is
not so good.

The right thing is to use non-repeating, unpredictable IV's.
One way to do this is to use E_k(sector number) as your IV,
as I mentioned earlier; or, if you want relocatibility, you
could use E_k(sector number + seed).

Ask on sci.crypt if you need more specific advice.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:41    [W:0.195 / U:4.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site