Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just the “key”, “IV” (nonce), and “counter start value”?

share|improve this question
@CodesInChaos it's CTR(Counter) mode, i've corrected my question – sim Dec 18 '13 at 2:49
up vote 1 down vote accepted

As you specified in the question, the key, nonce, and initial counter value are what is required in addition to the ciphertext and algorithm used.

However, it is best practice to have the initial counter always be 0. Common standards place no specific restrictions on the size of the nonce unless it is used in an authenticated encryption mode, but it is generally 96-bits, leaving 32-bits for the counter. A 32-bit counter allows 64 GiB of data to be encrypted per nonce using a 128-bit block cipher. A 32-bit 0-start counter is also more simple for software implementations. If you expect to send more than 64 GiB in a single message, you will need to reevaluate the counter size.

If you plan on having both the clients encrypt data with the same key, care must be taken so that there is no nonce overlap. 2 ways of doing this are prenegotiating a client to only use even or odd nonces, or having one of the clients use only nonces with the high bit set to 1.

share|improve this answer
Thanks for your answer. I'm thinking generate nonce randomly before encryption and prepended as plaintext to ciphertext. Is it safe enough to transmit nonce with ciphertext in such way ? – sim Dec 18 '13 at 6:19
Having the nonce be random is not a requirement, having it be unique per message is. If you are generating them randomly there is a probability of overlap; it is best to start with a random nonce and then increment by 1 for each message. The nonce is fine to send in plaintext, but should be included as part of any authenticated data. – Richie Frame Dec 18 '13 at 10:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.