# AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several possible strategies:

1. During the key exchange, A and B both generate and send nonces $N_a$ and $N_b$ which are mixed in the key derivation function with $S$ to produce a unique key for the exchange. We leave the IV = 0.
2. During the key exchange, A and B both generate and send nonces $N_a$ and $N_b$ which are mixed to produce and IV. The key is derived from S.
3. During the key exchange, A and B both generate and send $N_a$, $N'_a$, $N_b$, $N'_b$. $N_a$ and $N_b$ are mixed with $S$ to produce the key. $N'_a$ and $N'_b$ are mixed to produce the IV.

In other words: random key/fixed IV, fixed key/random IV or random key/random IV.

Which one is preferable? (Assume HMAC-SHA256 or similar for mixing keys/IV)

-
I'd mix everything to generate a 256 bit master-key from which I'd derive both the keys and the IVs. –  CodesInChaos Jul 8 '13 at 12:59
Definitely don't use an IV of 0 because then it is trivial to break the first block. To decide further, however, we need to know more about the threat model, and what your encryption is trying to defend against. Is AES-CTR a requirement, or could you upgrade to AES-GCM? –  xorbyte Jul 9 '13 at 22:16
@xorbyte in this case, this is simply protecting client-server communication for an online multiplayer game. The goal is to prevent players from eavesdropping, as well as sabotaging another player's turn by posing as that other player or replaying/modifying some of their actions. Finally, all player authentication and registration is done encrypted, so personal information is sent in the clear. –  Nuoji Jul 10 '13 at 12:21
@xorbyte AES-GCM used to be problematic because there aren't always standard implementations available. That said, even with GCM I would need an IV, right? –  Nuoji Jul 10 '13 at 22:11
Will $S$ be used to for only one plaintext/ciphertext? $\:$ If yes, why are you calling it "long-term"? $\hspace{.73 in}$ If no, will new nonce pairs be exchanged for additional messages? $\:$ In either case, there are likely $\hspace{.46 in}$ to be problems if you don't MAC the AES-CTR ciphertext with a computationally independent key. $\;\;\;$ –  Ricky Demer Jul 12 '13 at 3:44

Points "1" and "3" have equivalent security. Obviously "1" is less work. "2" leaves more potential for (key, IV) collisions if the $N$'s are too small or the attacker can control the $N$'s.