Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several possible strategies:

  1. During the key exchange, A and B both generate and send nonces $N_a$ and $N_b$ which are mixed in the key derivation function with $S$ to produce a unique key for the exchange. We leave the IV = 0.
  2. During the key exchange, A and B both generate and send nonces $N_a$ and $N_b$ which are mixed to produce and IV. The key is derived from S.
  3. During the key exchange, A and B both generate and send $N_a$, $N'_a$, $N_b$, $N'_b$. $N_a$ and $N_b$ are mixed with $S$ to produce the key. $N'_a$ and $N'_b$ are mixed to produce the IV.

In other words: random key/fixed IV, fixed key/random IV or random key/random IV.

Which one is preferable? (Assume HMAC-SHA256 or similar for mixing keys/IV)

share|improve this question
I'd mix everything to generate a 256 bit master-key from which I'd derive both the keys and the IVs. –  CodesInChaos Jul 8 '13 at 12:59
Definitely don't use an IV of 0 because then it is trivial to break the first block. To decide further, however, we need to know more about the threat model, and what your encryption is trying to defend against. Is AES-CTR a requirement, or could you upgrade to AES-GCM? –  xorbyte Jul 9 '13 at 22:16
@xorbyte in this case, this is simply protecting client-server communication for an online multiplayer game. The goal is to prevent players from eavesdropping, as well as sabotaging another player's turn by posing as that other player or replaying/modifying some of their actions. Finally, all player authentication and registration is done encrypted, so personal information is sent in the clear. –  Nuoji Jul 10 '13 at 12:21
@xorbyte AES-GCM used to be problematic because there aren't always standard implementations available. That said, even with GCM I would need an IV, right? –  Nuoji Jul 10 '13 at 22:11
Will $S$ be used to for only one plaintext/ciphertext? $\:$ If yes, why are you calling it "long-term"? $\hspace{.73 in}$ If no, will new nonce pairs be exchanged for additional messages? $\:$ In either case, there are likely $\hspace{.46 in}$ to be problems if you don't MAC the AES-CTR ciphertext with a computationally independent key. $\;\;\;$ –  Ricky Demer Jul 12 '13 at 3:44
show 2 more comments

1 Answer

Points "1" and "3" have equivalent security. Obviously "1" is less work. "2" leaves more potential for (key, IV) collisions if the $N$'s are too small or the attacker can control the $N$'s.

share|improve this answer
How do you figure (2) being sensitive to collisions? –  Nuoji Jul 12 '13 at 12:12
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.