# Use AES-256 Or AES-CTR-256 For One Block?

I am have one block of data to encrypt that is 32-bytes long. Is it better to use the AES-256 primitive for this single block (not a stream) or AES-256-CTR, and also would there be any cons or pros to using one and not the other such as to security or something else I am not thinking about.

This question relates to this question: AES-CTR-256 Sub Keys With Encrypted Sub Key Index

In relation I was wondering if I should just use the AES-256 to encrypt the sub-key with the master key instead of using the nonce and XOR operation, or maybe it would be better to use AES-256-CTR and use a nonce for the master key prefixed to the file.

-
AES256 refers to the key size. If I'm not wrong the block size is constant at 128 bits, isn't it? – srgblnch Jul 21 '14 at 15:12
@srgblnch - indeed. – hunter Jul 21 '14 at 15:13

Like said in the comments, a 256-bit message is two blocks of AES, no matter the keysize.

The main issue with ECB mode (i.e. using AES directly on 128-bit blocks) is that you leak whether two blocks are equal. When encrypting perfectly random data, that means there's a $2^{-128}$ chance the two parts of the key are equal, and the attacker knows that. The probability you see a collision between halves of any two keys becomes significant once you reach about $2^{63}$ keys, but that probably doesn't help the attacker much unless he knows one of the keys already.

In contrast, with CTR mode the chance that you get two equal ciphertext blocks is the same, but that only leaks the fact that the two halves are not equal, which helps the attacker a minuscule amount – and is always leaked by ECB. So CTR is obviously better. (Assuming you can ensure unique nonces.)

However, lets get realistic. In CBC mode, with random and unequal IVs, the attacker could instead learn the XOR of two key blocks with the same probabilities as above. Knowing that helps an attacker about as much as knowing an equality. Yet, we consider CBC a secure enough mode to use.

So I wouldn't really worry about it, but if you can easily use CTR it only costs you the IV storage. Even 128-bit keys would be secure, though.

Note: The above is only the case when you encrypt purely random data. With non-random data ECB is almost always broken. The above also assumes the attacker can't get a chosen plaintext encrypted or anything similar.

-
I really appreciate the very well written and informative answer. – kmcguire Jul 22 '14 at 18:14