I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately the master key will be unique¹.
My original plan was to simply set the nonce to 0. Assuming no collision happens when deriving the 128 bit AES key from the master key, this should as secure as conventional CTR, where the nonce is prepended to the message.
An alternative plan is to also derive the nonce from the master-key. This seems to offer two advantages:
- It makes key-nonce pair reuse more unlikely, since now they have 256 bits and not just 128
- It prevents some kinds of known-plaintext attacks, since the attacker now doesn't know the content of the counter-stream, effectively turning the nonce into some kind of secondary key.
Is there a problem with either scheme? Is the second scheme better than the first?
¹ assuming the 256 bit hashfunction I use is collision free