How does AES decrypt with a different IV?

Question

I am trying to learn more about AES encryption. AES encryption uses both the key and initialization vector (IV) for encryption, but since each IV is different, how does AES decrypt the ciphertext and return the plaintext?

• A Stick Figure Guide to the Advanced Encryption Standard (AES)

• MSC61-J. Do not use insecure or weak cryptographic algorithms

 

public static byte[] encrypt_cbc(SecretKey skey, String plaintext) {
    /* Precondition: skey is valid; otherwise IllegalStateException will be thrown. */
    try {
        byte[] ciphertext = null;
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        final int blockSize = cipher.getBlockSize();
        byte[] initVector = new byte[blockSize];
        (new SecureRandom()).nextBytes(initVector);
        IvParameterSpec ivSpec = new IvParameterSpec(initVector);
        cipher.init(Cipher.ENCRYPT_MODE, skey, ivSpec);
        byte[] encoded = plaintext.getBytes(java.nio.charset.StandardCharsets.UTF_8);
        ciphertext = new byte[initVector.length + cipher.getOutputSize(encoded.length)];
        for (int i=0; i < initVector.length; i++) {
            ciphertext[i] = initVector[i];
        }
        // Perform encryption
        cipher.doFinal(encoded, 0, encoded.length, ciphertext, initVector.length);
        return ciphertext;
    } catch (NoSuchPaddingException | InvalidAlgorithmParameterException | ShortBufferException |
        BadPaddingException | IllegalBlockSizeException | InvalidKeyException | NoSuchAlgorithmException e)
    {
        /* None of these exceptions should be possible if the precondition is met. */
        throw new IllegalStateException(e.toString());
    }
}

public static String decrypt_cbc(SecretKey skey, byte[] ciphertext)
    throws BadPaddingException, IllegalBlockSizeException /* These indicate corrupt or malicious ciphertext */
{
    try {
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        final int blockSize = cipher.getBlockSize();
        byte[] initVector = Arrays.copyOfRange(ciphertext, 0, blockSize);
        IvParameterSpec ivSpec = new IvParameterSpec(initVector);
        cipher.init(Cipher.DECRYPT_MODE, skey, ivSpec);
        byte[] plaintext = cipher.doFinal(ciphertext, blockSize, ciphertext.length - blockSize);
        return new String(plaintext);
    } catch (NoSuchPaddingException | InvalidAlgorithmParameterException |
        InvalidKeyException | NoSuchAlgorithmException e)
    {
        /* None of these exceptions should be possible if precond is met. */
        throw new IllegalStateException(e.toString());
    }
}

Answer 1

Generally the random IV - CBC requires an unpredictable IV - is prefixed to the ciphertext and "removed" before decryption. I've put removed in quotes as removing it may as well be copying it and skipping it afterwards. In principle it can be placed about anywhere near the ciphertext though. The IV for CBC mode is equal to the block size of the underlying cipher (Cipher#getBlockSize()), i.e. 16 bytes for AES, so the size is known in advance.

The IV doesn't need to be kept secret from an attacker.

In general the type and security of the IV depends on the mode of encryption. For CBC it is required to be unpredictable, for CTR (counter mode) it should not overlap another counter value and for GCM it needs to be a 12 byte nonce.

There are other ways of sharing an IV. For CBC it is for instance possible to keep a counter on both sides and encrypt that counter to form an IV (after encoding it to 16 bytes, of course). That way the IV doesn't need to be included with the ciphertext.