Initialization vector

In <a href="/facts/Cryptography/e94PEVau">cryptography</a>, an initialization vector (IV) or starting variable is an input to a <a href="/facts/Cryptographic_primitive/fy6vq5YM">cryptographic primitive</a> being used to provide the initial state. The IV is typically required to be <a href="/facts/Random/QJQBoEX5">random</a> or <a href="/facts/Pseudorandom/kfs1wfhY">pseudorandom</a>, but sometimes an IV only needs to be unpredictable or unique. <a href="/facts/Randomization/m5ctJfbM">Randomization</a> is crucial for some <a href="/facts/Encryption/16q29Fdv">encryption</a> schemes to achieve <a href="/facts/Semantic_security/PlW18aEh">semantic security</a>, a property whereby repeated usage of the scheme under the same <a href="/facts/Cryptographic_key/5W5PAmT4">key</a> does not allow an attacker to infer relationships between (potentially similar) segments of the encrypted message. For <a href="/facts/Block_cipher/MJywAyfQ">block ciphers</a>, the use of an IV is described by the <a href="/facts/Block_cipher_mode_of_operation/vIUabB2z">modes of operation</a>.
Some cryptographic primitives require the IV only to be non-repeating, and the required randomness is derived internally. In this case, the IV is commonly called a <a href="/facts/Cryptographic_nonce/ENHRCGnw">nonce</a> (a number used only once), and the primitives (e.g. <a href="/facts/Block_cipher_mode_of_operation/vIUabB2z">CBC</a>) are considered stateful rather than randomized. This is because an IV need not be explicitly forwarded to a recipient but may be derived from a common state updated at both sender and receiver side. (In practice, a short nonce is still transmitted along with the message to consider message loss.) An example of stateful encryption schemes is the <a href="/facts/Counter_mode/vIUabB2z">counter mode</a> of operation, which has a <a href="/facts/Sequence_number/WW4sPrt9">sequence number</a> for a nonce.
The IV size depends on the cryptographic primitive used; for block ciphers it is generally the cipher's block-size. In encryption schemes, the unpredictable part of the IV has at best the same size as the key to compensate for time/memory/data tradeoff attacks. When the IV is chosen at random, the probability of collisions due to the <a href="/facts/Birthday_problem/ct7ao4dF">birthday problem</a> must be taken into account. Traditional stream ciphers such as <a href="/facts/RC4/HAR5kL0T">RC4</a> do not support an explicit IV as input, and a custom solution for incorporating an IV into the cipher's key or internal state is needed. Some designs realized in practice are known to be insecure; the <a href="/facts/Wired_Equivalent_Privacy/LHqkdrCf">WEP</a> protocol is a notable example, and is prone to related-IV attacks.

Initialization vector open-in-new

Initialization vector