Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.

share|improve this question
up vote 8 down vote accepted

To expand on Thomas's answer, you have to transfer a CTR nonce somehow for the simple reason that you should need it to decrypt your data. Specifically, for a given block of data you calculate: $$p = N \oplus c(i)$$

Where $i$ is the count of the blocks you have used, $c$ is the count function which might be very straightforward, $N$ is your nonce and $\oplus$ is some combination operation. Your nonce makes this sequence $p$ unique. Without knowing it, you would not know how to start generating the plaintext that will be encrypted to generate the key stream.

Now, the reason you can distribute this in the clear is that each $p$ will be encrypted with the symmetric algorthim $S$ using key $k$. $k$ is kept secret, making it impossible to generate the keystream $s = S(p, k)$. The whole point of the block cipher $S$ is that you cannot go from the ciphertext to the plaintext without the key and since it is symmetric that should apply the other way around too.

At this point, being able to generate $p$ should be a non-issue because from there you should not be able to generate $s$.

share|improve this answer
One could generate the nonce together with the key from some password and salt (or from a key exchange algorithm's shared secret), and then not transfer it explicitely. – Paŭlo Ebermann Dec 10 '11 at 13:56

It is an IV and it is safe to transmit with the ciphertext (if it wasn't, we would call it a key).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.