At the risk of getting lost in the clipper chip discussion I give a  
summary on my recent question:


Unfortunately the answer is no - concealing the initialisation vector  
essentially doesn't give any additional security. I got 3 answers (from  
grady@netcom.com, Mark.Lomas@cl.cam.ac.uk, smb@research.att.com) that  
opened my eyes. It's pretty simple:

Say E is encryption (and D decryption) with key K on 64-bit blocks.

Let c[0] be the initialisation vector,
m[1], m[2], ... the message blocks,
c[1], c[2], ... the cipher text blocks.

Then encryption in cipher block chaining (CBC) mode works by the formula

   c[i] = E(m[i] XOR c[i-1]),

and decryption by

   m[i] = c[i-1] XOR D(c[i]).

So if the attacker doesn't have c[0] this only affects the first message  
block m[1]. But she can do her key search attack on m[2], m[3], ...

The situation in cipher feedback (CFB) mode is a bit more complicated but  
similar and left as an exercise for the reader :-)

Finally there is the modified output feedback mode (OFB) where DES (or  
whatever block cipher you use) simply acts as random generator by

   s[i] = E(s[i-1]) with initialisation vector (= seed) s[0],

and encryption is given by

   c[i] = m[i] XOR s[i].

Here the usual `known plaintext' attack against XOR-bitstream ciphers  
reduces the cracking to key search for K.
