Is it advisable to use AES CTR mode with the counter initialized to 0? How good is it in security terms?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
As long as you never re-use a specific counter value with the same key, counter mode protects the privacy of the message.
All counter values are equally secure. You just have to be sure never to re-use any counter value in two different messages. Zero is no different to any other counter value in this respect.
However, if you ever re-use any counter values then the secrecy of both messages is completely lost.
If you plan to encrypt many messages under the same key, then it would be wise to choose a different counter strategy to avoid the possibility of re-using counter values.
One such strategy is to allocate the first 64-bits of the block to the milliseconds since 1970. This is safe if the key is only used in a single thread and you don't encrypt more than one message per millisecond. This won't take the full 64-bits, so you can just fill the remaining bits at random. You then reserve the remaining 64-bits for the counter. This will make it difficult for two messages to use the same counter values.