Question

I’m testing AES encryption functions from this example. I have found that If I change IV to another random data, just a part of text will become inaccessible, and the other part will decrypt correctly.

This is my code:

    public static string encrypt(string original, string key, string iv)
    {
        string enc;
        // Create a new instance of the RijndaelManaged
        // class.  This generates a new key and initialization 
        // vector (IV).
        // Encrypt the string to an array of bytes.
        byte[] encrypted =EncryptStringToBytes_Aes(original, Convert.FromBase64String(key), Convert.FromBase64String(iv));

        enc = Convert.ToBase64String(encrypted);

        return enc;
    }

    public static string decrypt(string encrypted, string key, string iv)
    {
        string decrypted;

        decrypted = DecryptStringFromBytes_Aes(Convert.FromBase64String(encrypted), Convert.FromBase64String(key), Convert.FromBase64String(iv));

        return decrypted;
    }

And these are my EncryptStringToBytes_Aes and DecryptStringFromBytes_Aes functions.

For example, my input string is Hello, I think Hugo is a great movie!. It will be encrypted to lbMvxzBtu057yeNV5d/5MC7tlau7zfRXMtfLSUOBa7ueMGqRrm23H5uYGLmDcdJ3 with base64ed key gbpldgjBitwQXrQbbyHr+5J0cXADYAm+po8B29rYVJc= and base64ed IV Ti7OcORScdXS/Ll7m1KdeQ==. (I’m getting base64ed key and IVs as input of my functions, and I decode them in my function, as you can see in the code above)

Now if I change IV to m4u5eqD7BZP11P5PYGfV7Q== but do not touch the key, then try to decrypt the encrypted string, I’ll give this result: ��f+�T\/]�^h�ugo is a great movie!.

As you see, a part of input string (ugo is a great movie!) was decrypted successfully. Is that usual? If yes, How to prevent this? Is there any other algorithms which are more secure than this? And if no, What is wrong with my code?

Answer 1

If you use CBC, a wrong IV only prevents the decryption of the first block, i.e. the first 16 bytes in the case of AES. That’s by design and not a weakness.

See Can CBC ciphertext be decrypted if the key is known, but the IV not? for details of how CBC treats an IV.