Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:


  • The "counter field" is about: NONCE || CTR-VALUE.
  • I have multiples messages $M_a, M_b, M_c, \dots$
  • Each message can be divided into x-bits blocks ($M_{a1}, M_{a2}, M_{a3}, \dots$).

    1. Each message $M$ (for instance $M_a$) is encrypted following a randomly and uniquely generated key. In this case, does I really need the NONCE part of the "counter field" ?

    2. If I really need a nonce, and knowing that each key is again unique-per-message, is there a secure way to derivate the nonce from the key ?

share|improve this question

marked as duplicate by otus, Gilles, e-sushi, Seth, poncho Aug 26 '14 at 15:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted

The once part inside of the nonce in CTR mode means effectively "once for this particular key".

If you use a fresh key for each message (e.g. by encrypting it using public-key crypto or similar), you can use the same nonce for all the messages (or a size-zero nonce).

The important part is that the combination of nonce and ctr-value (i.e. what is input into the block cipher) is not repeated while using the same key.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.