# Why must IV/key-pairs not be reused in CTR mode?

Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation so far as to why this is the case.

The issue is obvious if the attacker can manage to obtain the plain text and its corresponding cipher text for one piece of the data - but if no known plain texts are available, how could an attacker reconstruct the key-stream from just the IV value?

Can the security issues be mitigated by keeping the IV secret too? E.g. would an attacker have any realistic chance of cracking the encryption by just knowing that key/IV-pairs have been reused in the creation of two different ciphertexts, but nothing more?

-
Have a look at our question How does one attack a two-time pad (i.e. one time pad with key reuse)? and its recent duplicate How can I find two strings $m_1$ and $m_2$, knowing that I know $m_1 \oplus m_2$?. The same attack principle is valid for every synchronous stream cipher (and CTR mode is an example of this). – Paŭlo Ebermann Jun 20 '12 at 18:02
If after reading this there is still something open, please edit your question accordingly. – Paŭlo Ebermann Jun 20 '12 at 18:02
For anyone else landing here later on, this link (from this question ) probably explains it best. Thanks for the hint about the "two-time pad" Paŭlo Ebermann and poncho! – Dexter Jun 20 '12 at 21:18

## 1 Answer

Yes, the attacker would have a realistic chance of recovering plaintext, and preventing him from knowing the IV values does not reduce this risk.

The problem is that CTR mode encryption is effectively:

$C = P \oplus F(Key, IV)$

where $P$ is the plaintext, $C$ is the ciphertext, and $F$ is a complex function of its two inputs.

The problem with this is if you encrypt two different plaintexts with the same $Key$, $IV$ values, then the attacker gets two pairs:

$C_1 = P_1 \oplus F(Key, IV)$

$C_2 = P_2 \oplus F(Key, IV)$

Where he can see the values $C_1$, $C_2$. With those, he can then compute:

$C_1 \oplus C_2 = P_1 \oplus P_2$

and thus deriving the value of the two plaintexts exclusive-or'ed together.

As for how that can be attacked, well, you can find two examples against ASCII-English plaintexts here and here.

And, note that since the attacker didn't actually use the IV value, it doesn't matter to him whether he knows it or not.

-