AES/CBC/PKCS5Padding 加密与固定 IV（或没有）

Question

I need to code a Java function that encrypts a string using AES256, with CBC mode and PKCS#5 padding. I've been given a secret key and some before-after examples so I can validate my implementation. This is all I've got. I found that the expected results are exactly the one produced by this online generator: https://encode-decode.com/aes-256-cbc-encrypt-online/

One of the parameters I must provide my Cipher instance with is an initialization vector ("IV"). If I don't specify one, Java uses a random one, and therefore produces a different result on each run, which is not the behavior I want.

The above generator does not ask its users for an IV, and still it produces the same results as my target. So I'd like to know how it is possible. Do people tend to use the same IV (regardless of whether it's secure or not), something like "0000000000000000", "1234567812345678" (I tried both, just in case)? Or is there any other way to encrypt with the above parameters without using an IV?

Just in case, here is my code for the moment:

package com.example.test;

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class AesTest {
    public static String key = "abcdefghijklmnopqrstuvwxyz012345";
    public static String email = "test@example.com";
    public static String initVector = "????????????????";

    public static void main(String []args) {
        try {
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");

            cipher.init(
                Cipher.ENCRYPT_MODE,
                new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "AES"),
                new IvParameterSpec(initVector.getBytes(StandardCharsets.UTF_8))
            );

            byte[] encrypted = cipher.doFinal(email.getBytes());
            System.out.println(Base64.getEncoder().encodeToString(encrypted));
        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }
}

Answer 1

Yes, generally an all zero IV is used as default, if it is not randomized by default. The initialization vector is XOR'ed with the first plaintext block for CBC, so if all bytes are set to value zero then the plaintext is simply kept.

This can be easily checked by performing both ECB and CBC on a full block of plaintext. Eg encryption of ASCII aaaaaaaaaaaaaaaa , ie 16 a characters will result in the following ciphertext for ECB:

mExSanM1tVyEV1hjSqBlTZcuxSr1ybN1rpCtwYiyIYg=

and this one for CBC:

mExSanM1tVyEV1hjSqBlTcZkEjmYpQWV7Nmnr0thwhw=

Quite clearly the first blocks must be identical, as ECB doesn't use an IV. So the first block encrypt is directly over the plaintext, just as you expect with an all zero IV.

Note that CBC only provides semantic security if the IV is fully unpredictable to an adversary, ie all bits in the IV must appear random to an adversary.

For Java you can just create an IvParameterSpec like this:

new IvParameterSpec(new byte[cipher.getBlockSize()]);