加密：使用初始化向量还是密钥？
我正在使用 PHP 的 mcrypt 库和 AES-256 (rijndael) 算法，该算法需要密钥 + 初始化向量才能运行。
我的逻辑头脑并不真正同意这一点。 只有一把钥匙还不够吗？
理论场景：
如果我将加密的敏感数据存储在数据库中，只有所有者才能解密，那么使用用户散列密码作为其数据的密钥或初始化向量是否合适？
密钥应该被认为比初始化向量更私密还是相反？
I am using PHP's mcrypt library and the AES-256 (rijndael) algorithm, which requires both a key + initialization vector to run.
My logical brainside isn't really going along with this. Isn't just one key enough?
Theoretical scenario:
If I had encrypted sensitive data stored in a database, which only the owner should be able to decrypt, would it be appropriate to use the users hashed password to either the key or the initialization vector to his or her data?
Should the key be considered more private than the initialization vector or is it the other way around?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
不，事实上 IV 在大多数实现中都至关重要。 IV 也被认为对于公众使用是安全的，例如，对于 WEP 和 WPA1/WPA2，IV 以纯文本形式传输。当使用相同的密钥+iv 来加密相同的纯文本时，就会出现问题。除非您使用 IV，否则密文将是相同的。如果攻击者可以用这个密钥加密任意明文，然后查看密文。这是暴力破解攻击者获得的其他密文的一种更快的方法。
不仅如此，IV 必须是随机的，否则将违反 CWE-329< /a>.这是一个问题的原因有点微妙，我一开始没明白。您没有提到这一点，但我希望您使用 CBC 或 CMAC 模式
对密码使用哈希函数与使用 String2Key 函数几乎相同。只要攻击者无法使用 SQL 注入来获取密钥，这就是一个可靠的设计。
No, in fact an IV is vital in most implementations. The IV is also considered to be safe for public use, for instance the IV is transmitted in plain text for WEP and WPA1/WPA2. The problem arises when this same key+iv is used to encrypt the same plain text. The cipher texts will be identical, unless you use an IV. If an attacker can encrypt arbitrary plain text with this key, and then view the cipher text. This is a much faster way of brute forcing other cipher text that the attacker has obtained.
Not only that, the IV must be random or you would be in violation of CWE-329. The reason why this is a problem is a bit more subtle and I didn't get it at first. You didn't mention this, but i hope you are using either the CBC or CMAC modes
The use of a hash function on a password is nearly identical to using a String2Key function. This is a solid design so long as an attacker can't use SQL Injection to obtain the key.
初始化向量（IV）根本不是密钥，也不是秘密。事实上，它经常被暴露（例如，添加到加密数据之前）。它用作加密算法的附加随机输入，以便每次使用不同的 IV 时，加密相同的明文数据的结果都会不同。这样，就无法对加密数据进行统计。它本身不会“提高”加密强度。
您可以在此处查看精美的图表，显示如何以及为何使用 IV。
Initialization Vector (IV) is not a key at all, and is not secret. In fact, it is often exposed (e.g. prepended to the encrypted data). It is used as an additional random input to the encryption algorithm so that the result of encrypting the same clear data is different each time you use a different IV. This way, statistics cannot be gathered on the encrypted data. It does not "improve" the encryption strength by itself.
You can look here for nice diagrams showing how and why IV is used.
不要使用散列密码作为密钥和 IV 的单一来源。根据经验，每次更新加密数据时都应该生成随机 IV 并使用该数据存储 IV。密钥可以多次重复使用，但也可以使用盐散列并将盐与数据一起存储。
如果您只是散列用户密码并将其用作加密密钥，则具有相同密码的用户将拥有相同的密钥。根据您的数据库结构和入侵者访问权限，可能会出现一些不幸的情况，即可以检测到具有相同密码的用户。至少向此哈希添加唯一的用户名。
如果每次数据更新时不更改 IV，则有关数据更改的信息可能会泄露。使用CBC或CFB模式，相同的第一个明文块将被加密为相同的密文，直到第一个明文发生变化，因此可以确定该变化的位置。
Do not use hashed password as a single source for key and IV. As a rule of thumb, you should generate random IV EVERY TIME you update encrypted data and store IV with this data. Key can be reused multiple times, but use salted hashing and store salt with data too.
If you just hash user passwords and use it as encryption keys, users with same passwords will have same keys. Depending on your database structure and intruder access rights there could be some unfortunate cases when users with same passwords can be detected. Add at least unique username to this hash.
If you do not change IV for every data update, information about data changes can be leaked. With CBC or CFB mode identical first plaintext blocks will be encrypted to identical ciphertext until first plaintext change, so position of this change can be determined.
如果您使用分组密码的 EBP 模式或大多数流密码，则不同明文上的相同密钥 + IV 组合将为攻击者提供对密钥的 XOR 结果的直接查看。通过扩展，这揭示了密钥本身，并在某种程度上揭示了密码。
但我的意思是静脉注射绝对有必要吗？不会。只要您每次在下一个明文块上更改密码（即使是第二次相同的块），无需 IV 就完全没问题。事实上，IV 所做的就是上述过程的自动化。
If you're using the EBP mode of the block cipher, or most of the stream ciphers, identical key+IV combinations on different plaintexts will offer the attackers a direct view on the XOR result of the key. This by extension reveals the key itself and to some extent the password.
But do I mean IVs are definitely necessary? No. As long as you change your password each and every time on your next plaintext block(even the same block the second time), you're completely fine without IVs. In fact, all that an IV does is the automation of the above process.