Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

As I understand it, CTS pads the last block and swaps it with the second last to compensate for a partial block of data. I have written a DRBG (Deterministic Random Bit Generator) using AES-CBC that only accepts an input size which falls on the block boundary.

Is CTS really necessary here? I can't imagine a way in which it's absence will affect the entropy of the output. Am I understanding this correctly?

share|improve this question
Could you show us the actual DRBG algorithm you've implemented? Normally CTS would not be required, but that depends on the actual algorithm. –  owlstead Jun 3 at 15:40
The AES class, it's based on mono/bouncycastle with fixed params (256/128) and CBC done in-class. The generator that calls the class creates keys/IV and random start pos for monotonic integer arrays equal to 4Kib. The key/IV/Pos are stored in a key used to generate random data at either end for a Vernam cipher. It's large and complex, just let me know what you want me to post.. –  John Jun 3 at 15:49
Tried to answer it without additional knowledge. –  owlstead Jun 3 at 16:03

1 Answer 1

up vote 4 down vote accepted

Normally you don't want to reverse the encryption used within a DRBG. Schemes like PKCS#7 padding and CTS are required to deterministically reverse the padding during decryption. If you just want to have a final block, you should be fine by using zero padding until the end of the block.

Of course, if this zero padding is actually harming the output of your DRBG depends on the algorithm.

share|improve this answer
I guess my point was.. it doesn't need any padding, because final block is always a full block. So in this case, where padding is never required, would I even need CTS? I don't think so.. but just double-checking –  John Jun 3 at 16:23
For full blocks you don't need to do anything with regards to padding. I don't think CTS will have much influence on the quality of the output though, but in general I would not use it for this kind of purpose. –  owlstead Jun 3 at 20:45
Thanks owlstead.. I did some more research and moved it to a counter(SIC) implementation.. –  John Jun 3 at 21:44
Ah, that's more like it. CBC is not the best for this. Note that just using CTR is not enough; if you use CTR mode encryption on static valued blocks you can be certain that no blocks will be repeated. That means you can predict that certain values are not in the following blocks. –  owlstead Jun 3 at 21:48
Laid out simply.. it is aes ctr encrypting arrays of ascending integers each started at a random position. 1024 * int32 to equal a block of 4096 bytes of random data, then a new key/iv/pos and so on to create a 'pad' file.. does this sound right? –  John Jun 3 at 21:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.