Subject: RE: [AAA-WG]: Issues 188, 189 and 190

From: [email-masked]
Date: Thu, 4 Oct 2001 10:23:25 +0300

> From: ext Glen Zorn [mailto:[email-masked]]
>
> I'm unfamiliar w/the practice of deriving IVs from secret
> material.  Since
> IVs are often transmitted in the clear, could this not
> release information
> about the master key itself?

The IV doesn't have to be secret but it should be integrity
protected, at least with CBC. Otherwise an adversary can modify
the IV to make predictable bit changes to the first plaintext
block recovered. Using a secret IV is one method for preventing
this. Sending the IV in the clear and protecting it (and the
message itself) with a MAC is another method.

Regards,
Henry

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 4 Oct 2001 03:32:15 -0700

Henry Haverinen [mailto:[email-masked]] writes:

> this. 

but secrecy != integrity protection...

> Sending the IV in the clear and protecting it (and the