summary des init vector as additional key at the risk of getting lost in the clipper chip discussion i give a summary on my recent question in article pqscbcnh minnie zdv uni mainz de i wrote the recent discussion in this news group suggests that a key search attack against des is quite feasible now but normally des is applied in cbc or cfb mode where one chooses a random init vector of bytes questions makes it sense to handle the init vector as an additional key then we have a bit key if yes is anything known about the security of this key scheme can we break it faster than by exhaustive search through the bit key space unfortunately the answer is no concealing the initialisation vector essentially doesn t give any additional security i got answers from grady netcom com mark lomas cl cam ac uk smb research att com that opened my eyes it s pretty simple say e is encryption and d decryption with key k on bit blocks let c be the initialisation vector m m the message blocks c c the cipher text blocks then encryption in cipher block chaining cbc mode works by the formula c i e m i xor c i and decryption by m i c i xor d c i so if the attacker doesn t have c this only affects the first message block m but she can do her key search attack on m m the situation in cipher feedback cfb mode is a bit more complicated but similar and left as an exercise for the reader finally there is the modified output feedback mode ofb where des or whatever block cipher you use simply acts as random generator by s i e s i with initialisation vector seed s and encryption is given by c i m i xor s i here the usual known plaintext attack against xor bitstream ciphers reduces the cracking to key search for k klaus pommerening institut fuer medizinische statistik und dokumentation der johannes gutenberg universitaet obere zahlbacher strasse w mainz germany
