RE: Initialization Vector

I think this will be a hot topic during our next meeting whenever
and wherever that may be.  Personally, I have not come to a conclusion 
and would like to hear others' thoughts on this.  

Ed

P.S.  I think I will change the name of 'EncryptedNode' to 
'EncryptedData' so we don't imply the encrypted thing is 
necessarily XML.

-----Original Message-----
From: Philip Hallam-Baker [mailto:pbaker@verisign.com]
Sent: Monday, September 11, 2000 11:03 AM
To: 'Hiroshi Maruyama'; Ed Simon
Cc: Public XML Encryption List
Subject: RE: Initialization Vector


Managing separate IVs for every encrypted node may get tiresome.

Since every ciphertext stream needs an IV why not simply prefix it to
the ciphertext? That way the temptation to 'reuse' IVs is avoided and
the IV is always in the same place as the ciphertext.

I am thinking of a bunch of 'content management' type possibilities.
Consider the case where we have a detached decryption blob. One blob
might map to a hundred ciphertext streams. If the IV is packaged with
the decryption blob I have to compile the crypto manifest in advance -
bad plan for streaming video. If on the other hand the IV is packaged
with the ciphertext I don't need any additional info.

		Phill

> -----Original Message-----
> From: Hiroshi Maruyama [mailto:MARUYAMA@jp.ibm.com]
> Sent: Sunday, September 10, 2000 9:06 PM
> To: Ed Simon
> Cc: Public XML Encryption List
> Subject: Initialization Vector
> 
> 
> 
> 
> Ed,
> I think you are working on the syntax of encrypted contents.
> One thing that I have noticed is that, if we want to separate
> EncryptionInfo and EncryptedNode (whatever name
> we choose :-)) so that the same key can be shared with
> multiple contents, we need to include an initialization vector
> for each EncryptedNode, as in
> 
>   <EncryptedNode
>       NodeType="Element"
>       EncryptionInfo="URL to key"
>       IV="Base64-encoded IV">
> 
> because otherwise one may know whether two encrypted nodes
> have the same prefix.
> 
> Hiroshi
> 
> --
> Hiroshi Maruyama
> Manager, Internet Technology, Tokyo Research Laboratory
> +81-46-215-4576
> maruyama@jp.ibm.com
> 
> 

Received on Monday, 11 September 2000 16:08:05 UTC