Editing Initialization vector (section)

== SSL 2.0 IV ==

In [[Block cipher mode of operation#Cipher_block_chaining_(CBC)|cipher-block chaining mode]] (CBC mode), the IV need not be secret, but must be unpredictable (In particular, for any given plaintext, it must not be possible to predict the IV that will be associated to the plaintext in advance of the generation of the IV.) at encryption time. Additionally for the [[Block cipher mode of operation#OFB|output feedback mode]] (OFB mode), the IV must be unique.<ref>{{citation |author = Morris Dworkin |title = NIST Recommendation for Block Cipher Modes of Operation; Chapters 6.2 and 6.4 |date = 2001 |url = https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf }}</ref> In particular, the (previously) common practice of re-using the last ciphertext block of a message as the IV for the next message is insecure (for example, this method was used by SSL 2.0). If an attacker knows the IV (or the previous block of ciphertext) before he specifies the next plaintext, he can check his guess about plaintext of some block that was encrypted with the same key before. This is known as the TLS CBC IV attack, also called the [[Transport Layer Security#BEAST attack|BEAST attack]].<ref>{{citation |author = B. Moeller |title = Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures |date = May 20, 2004 |url = http://www.openssl.org/~bodo/tls-cbc.txt |access-date = September 1, 2014 |archive-date = June 30, 2012 |archive-url = https://web.archive.org/web/20120630143111/http://www.openssl.org/~bodo/tls-cbc.txt |url-status = dead }}</ref>