兰德应该用于静脉注射吗？

Question

CBC mode for AES specifies that to make each message unique, an IV should be used. The IV should be random and only used once, otherwise it may allow people to decrypt other cipher texts which used the same key.

Is the rand() function in C suitable for generating this IV? Does the fact that it is normally seeded with the current time make it vulnerable to some sort of attack?

Answer 1

The quick answer is NO . Don't use a non cryptographically-secure random generator for initialization vectors. The initialization vectors are sent unencrypted, so one could think they can be generated by one of these functions. But this should lead to weakness, and I'll explain: If you use a poor (and rand() is such a weak random routine) you'll narrow the space of possible IVs you are generating. An example will suffice:

Let's suppose you are using a 8 bytes IV in some encrypted message. But the random function you use has a 8 bit seed, there are only 256 possible byte sequences to be generated from such a poor random function, so probably there will be only a maximum of 256 possible IVs generated (even if they show pure randomness, or a wide spread hash values over the whole space) An attacker knowing this, can reproduce the whole 256 space of possible IV making them completely useless.