Search code examples
cryptographyencryption-symmetric

Is encrypting low variance values risky?


For example a credit card expiry month can be only of only twelve values. So a hacker would have a one in twelve chance of guessing the correct encrypted value of a month. If they knew this, would they be able to crack the encryption more quickly?

If this is the case, how many variations of a value are required to avoid this? How about a bank card number security code which is commonly only three digits?


Solution

  • If you use a proper cipher like AES in a proper way, then encrypting such values is completely safe.

    This is because modes of operation that are considered secure (such as CBC and CTR) take an additional parameter called the initialization vector, which effectively randomizes the ciphertext even if the same plain text is encrypted multiple times.

    Note that it's extremely important that the IV is used correctly. Every call of the encryption function must use a different IV. For CBC mode, the IV has to be unpredictable and preferably random, while CTR requires a unique IV (a random IV is usually not a bad choice for CTR either).