Known-IV, known-in-advance-IV, and replayed-and-known-IV attacks on multiple modes of operation of block ciphers

Normally, it has been believed that the initial values of cryptographic schemes do not need to be managed secretly unlike the secret keys. However, we show that multiple modes of operation of block ciphers can suffer a loss of security by the state of the initial values. We consider several attacks according to the environment of the initial values; known-IV attack, known-in-advance-IV attack, and replayed-and-known-IV attack. Our attacks on cascaded three-key triple modes of operation requires 3-7 blocks of plaintexts (or ciphertexts) and 3 • 2⁵⁶-9 • 2⁵⁶ encryptions. We also give the attacks on multiple modes proposed by Biham.