note 40878 added to function.mcrypt-create-iv

From http://www.ciphersbyritter.com/GLOSSARY.HTM#IV (linked to above): "While it is often said that IV values need only be random-like or unpredictable, and need not be confidential, in the case of CBC mode, that advice can lead to man-in-the-middle attacks on the first plaintext block. If a MITM opponent knows the usual content of the first block, they can change the IV to manipulate that block (and only that block) to deliver a different address, or different dollar amounts, or different commands, or whatever. And while the conventional advice is to use a MAC at a higher level to detect changed plaintext, that is not always desirable or properly executed. But the CBC first-block problem is easily solved at the CBC level simply by enciphering the IV and otherwise keeping it confidential, and that can be reasonable even when a MAC will be used later." ---- Manual Page -- http://www.php.net/manual/en/function.mcrypt-create-iv.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+40878 Delete -- http://master.php.net/manage/user-notes.php?action=delete+40878&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+40878&report=yes Search -- http://master.php.net/manage/user-notes.php