Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC.

Is reusing the same key several times dangerous in AES-CBC mode? Does the use of a random IV preclude all possible attacks in such cases?

share|improve this question
"keys must not be reused in AES-CTR" This claim is wrong. Keys can be safely reused in CTR mode, as long as the probability that the counter ranges intersect is negligible. –  Maeher Sep 22 '13 at 5:52
To clarify @Maeher's point, the problem is re-use of the same IV with a given key. Reusing the same key with AES-CBC is not necessarily problematic, but reusing the same key with the same nonce is. As a side note, if at all possible you should be using an authenticated encryption mode like AES-GCM. –  Stephen Touset Sep 22 '13 at 7:19

1 Answer 1

up vote 2 down vote accepted

Key/IV pairs should not be reused for either AES-CTR and AES-CBC - or for any other symmetric cipher for that matter. As a cipher is a Pseudo Random Permutation (PRP) inserting the same input will result in identical output. If you perform that operation you will leak information to an attacker; the attacker can distinguish data with the same contents.

CTR is a streaming mode for block ciphers. In AES-CTR the key stream depends only on the key and the IV. The key stream is then XOR-red with the plaintext. This means that in addition to the above issue, you will very quickly find additional information about the plain text if you XOR the ciphertexts together. To be precise, it will be very easy to retrieve partial or full plain text from only a small set of ciphertexts. The key would be still safe, but the plaintext is not.

Reusing the key for any cipher should be no issue as long as the IV is unique enough. In the case of CTR the IV should be unique enough to make sure that the counter does not repeat. Please read into CTR mode to see what that means when generating an IV. Make sure that you understand what IV/nonce means for your specific implementation to, the terms can be mixed up and may be used differently from one implementation to another.

Using a 16 byte value that is indistinguishable from random to an attacker should indeed preclude any attacks on the block cipher mode.

share|improve this answer
I think a quick way to summarize this is: reusing a key/IV with CBC is bad. Reusing a key/nonce with CTR is catastrophic. –  Jeffrey Goldberg Sep 24 '13 at 6:40
@JeffreyGoldberg correct, unless you use fully randomized plaintext (but in that case ECB is secure as well) –  Maarten Bodewes Sep 24 '13 at 12:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.