Study. uk . com
  1. Home
  2. All questions
  3. Question 28

CISSP study material · question 28 of 500

A developer encrypts customer records with AES in Cipher Block Chaining (CBC) mode and derives each initialisation vector (IV) from the record's primary key, so that decryption can recompute the IV without storing it. A reviewer objects to the design. Which change should the reviewer require?

  1. Keep the derived IV and prepend a secret salt so that its value cannot be guessed.
  2. Keep the derived IV and move to a 256-bit record encryption key so the stored ciphertext resists analysis.
  3. Keep the derived IV but hash it with SHA-256 first so the stored value is unpredictable.
  4. Generate each IV with a cryptographically secure random generator and store it alongside the ciphertext.
Show the answer

Answer: D. Generate each IV with a cryptographically secure random generator and store it alongside the ciphertext.

CBC needs an unpredictable, non-repeating IV from a cryptographically secure generator; deriving it from record data makes it deterministic and repeatable across re-encryptions of that record.

Source: OWASP Top 10 A04:2025 (OWASP) — OWASP Top 10:2025 A04 Cryptographic Failures > How to prevent

Challenge yourself on this topic → Study as cards