Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

learn more… | top users | synonyms

8
votes
4answers
2k views

Is SHA-256 secure as a CTR block cipher?

Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x. We represent numbers in simple binary instead of a counting function. <...
10
votes
1answer
18k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
6
votes
1answer
4k views

Why must IV/key-pairs not be reused in CTR mode?

Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ...
3
votes
2answers
738 views

Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
9
votes
1answer
2k views

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
6
votes
1answer
2k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
6
votes
2answers
593 views

Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?

As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so: ...
10
votes
1answer
2k views

Why not use CTR with a randomized IV?

I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
0
votes
1answer
100 views

Explain same encryption time for two files of different sizes

I am encrypting files in a two layered fashion as follows: Inner layer is 128 bit AES-CTR encryption Outer/Second layer is a simple one time padding with a particular key. While testing the ...
2
votes
2answers
6k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...
7
votes
2answers
356 views

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
6
votes
1answer
447 views

Why doesn't CTR mode require blocking?

I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of ...
5
votes
2answers
209 views

Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says: A nonce N of 15-L octets. Within the ...
4
votes
2answers
403 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
4
votes
1answer
196 views

Strategy for random CTR initial counter values

Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything ...
2
votes
1answer
261 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
2
votes
1answer
555 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
2
votes
3answers
610 views

How do I produce a stream of secure random numbers from AES-Counter mode?

I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly. I have read that AES-CTR can produce a stream of ...
10
votes
1answer
1k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
4
votes
1answer
104 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
4
votes
2answers
142 views

Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
4
votes
2answers
211 views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
3
votes
1answer
585 views

Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
1
vote
0answers
50 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
0
votes
1answer
46 views

Security of AES CTR with multiple messages containing the same known plain text

I have this scenario: The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using ...