Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am have one block of data to encrypt that is 32-bytes long. Is it better to use the AES-256 primitive for this single block (not a stream) or AES-256-CTR, and also would there be any cons or pros to using one and not the other such as to security or something else I am not thinking about.

This question relates to this question: AES-CTR-256 Sub Keys With Encrypted Sub Key Index

In relation I was wondering if I should just use the AES-256 to encrypt the sub-key with the master key instead of using the nonce and XOR operation, or maybe it would be better to use AES-256-CTR and use a nonce for the master key prefixed to the file.

share|improve this question
AES256 refers to the key size. If I'm not wrong the block size is constant at 128 bits, isn't it? – srgblnch Jul 21 '14 at 15:12
@srgblnch - indeed. – hunter Jul 21 '14 at 15:13
up vote 2 down vote accepted

Like said in the comments, a 256-bit message is two blocks of AES, no matter the keysize.

The main issue with ECB mode (i.e. using AES directly on 128-bit blocks) is that you leak whether two blocks are equal. When encrypting perfectly random data, that means there's a $2^{-128}$ chance the two parts of the key are equal, and the attacker knows that. The probability you see a collision between halves of any two keys becomes significant once you reach about $2^{63}$ keys, but that probably doesn't help the attacker much unless he knows one of the keys already.

In contrast, with CTR mode the chance that you get two equal ciphertext blocks is the same, but that only leaks the fact that the two halves are not equal, which helps the attacker a minuscule amount – and is always leaked by ECB. So CTR is obviously better. (Assuming you can ensure unique nonces.)

However, lets get realistic. In CBC mode, with random and unequal IVs, the attacker could instead learn the XOR of two key blocks with the same probabilities as above. Knowing that helps an attacker about as much as knowing an equality. Yet, we consider CBC a secure enough mode to use.

So I wouldn't really worry about it, but if you can easily use CTR it only costs you the IV storage. Even 128-bit keys would be secure, though.

Note: The above is only the case when you encrypt purely random data. With non-random data ECB is almost always broken. The above also assumes the attacker can't get a chosen plaintext encrypted or anything similar.

share|improve this answer
I really appreciate the very well written and informative answer. – kmcguire Jul 22 '14 at 18:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.