Take the 2-minute tour ×

Can we use symmetric-key algorithms without an initialization vector?

I am making an app where both the sender and receiver share a key and there is no way to create an initialization vector for each encryption. So I was thinking about setting the initialization vector to NULL while encrypting. Am I allowed to set the IV to NULL or can I use symmetric-key algorithms without an initialization vector?

share|improve this question
What is the underlying issue behind "there is no way to create an initialization vector for each encryption"? Do you need length preserving encryption? Or deterministic encryption? Or is there no CSPRNG? –  CodesInChaos Sep 2 '13 at 10:04
Could you also specify the data that is being exchanged –  Alexandre Yamajako Sep 2 '13 at 11:58

4 Answers 4

If you really can't use an IV (why?), then just about the best thing you can do is use something like SIV mode (RFC 5297). SIV is a "maximally misuse-resistant" authenticated encryption mode which provides the following characteristics:

  • If every message is tagged with a unique nonce, SIV provides full IND-CCA2 security (up to the usual limits; i.e. it still leaks the length of the message).

  • Without a nonce, SIV remains IND-CCA2 secure as long as the same message is never encrypted twice (with the same associated data, if any).

  • If a message is encrypted twice without a nonce (or with an accidentally reused nonce), the only thing an attacker can learn is that those two messages are the same.

The down side of SIV mode is that it's a two-pass encryption mode: the encryption code must process the message twice. Thus, it is best suited for fairly short messages that can be held entirely in memory. Basically, on the first pass, SIV computes a secure message authentication code of the plaintext and any associated data (including the nonce, if provided); on the second pass, the message is encrypted using conventional CTR mode encryption, with the MAC from the first pass used as a "synthetic IV" (whence the name of the mode).

Also, to allow the message to be decrypted (and its authenticity verified), the 128-bit MAC/IV must be transmitted along with the message. Thus, SIV adds an unavoidable 16-byte overhead to each message, and is therefore not suited for format-preserving encryption. Of course, the same is true of every authenticated encryption mode, and indeed of every mode capable of providing semantic security, whether authenticated or not.

share|improve this answer

Probably not safely and in the way you mean. The NULL IV is completely unsafe.

There are deterministic encryption schemes used for things like searchable encryption, de duplication/convergent cryptography, and key wrapping. They leak a lot of data about the underlying file you are encrypting. In general, they are not safe for generic use. Don't use them.

There are systems that don't use an IV, but use something else. An IV must be unpredictable and unique. As such you must send a fresh one with every message. A nonce, short for number used once, has the sole requirement that it only be used once. It can be predictable. Both OCB and Counter Mode require only a nonce. You could, for example, keep a counter on both ends along with the key and increment it every time to derive your nonces.

However, great care must be taken to ensure you don't reuse a nonce (i.e. if your counters get out of sync or something). In practice, it's way easier to just prepend the cleartext random nonce/IV to the front of the cipher-text and send it. Why exactly in your case is this not possible? Are your cipher text's limited in length?

share|improve this answer


I don't know your constraints, but if the problem is difficulty with random number generation, then it may help to know that you don't have to randomly generate the IV, it's perfectly valid to create an IV by encrypting a unique number using the key and using the result as the IV.

If transporting the IV is a problem, the unique number could even be a counter that both sides maintain and use to derive the IV at encryption/decryption time.

share|improve this answer
transportation of IV is my problem –  jithin Sep 3 '13 at 5:13
Do you need the ciphertext to have the same length as the plaintext? $\;$ –  Ricky Demer Sep 3 '13 at 10:07

No, you can't.

A symmetric encryption scheme without a random IV is not sure at all. The scheme is deterministic.

from wikipedia:




share|improve this answer
I guess what Ricky is trying to say is : it largely depends on what kind of data is sent... –  Alexandre Yamajako Sep 2 '13 at 11:57
You can also use systems that only require a nonce(number used once) instead of a random, unpredictable IV. The nonce can be a counter. OCB mode (also by Rogaway) does this. So does counter mode. –  imichaelmiers Sep 2 '13 at 18:24

Your Answer


