Questions tagged [ctr]
Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.
261
questions
0
votes
1
answer
238
views
Encrypting the nonce in AES-CCM
I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
0
votes
0
answers
67
views
Exposing the vulnerability of CTR mode of operation
In the CTR mode of operation, the plaintext block is treated as a stream cipher, where each byte of the plaintext gets XOR-ed with each byte of the key (which is generated using a nonce and a counter) ...
- 101
3
votes
2
answers
382
views
What input parameters can be made public in the AES-CTR mode?
Preface: I am beginner of cryptography and not native English speaker. So I may make terrible mistake (about grammar and cryptography).
I understand that the parameters used for AES-CTR are "key&...
- 31
0
votes
0
answers
39
views
Using a hash instead of AES-CTR before XORing a plaintext [duplicate]
In AES-CTR, a key, a nonce and a counter are all encrypted to produce a value that is then XORed with a plaintext to produce the ciphertext.
Let's say we were to make a hash out of the key, the nonce ...
- 101
1
vote
2
answers
3k
views
How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?
Respected community,
I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker.
Is it easy ...
- 1,020
0
votes
1
answer
92
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 103
1
vote
2
answers
333
views
Encrypting random IV in CTR mode (no nonce!)
Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
- 343
1
vote
1
answer
189
views
How CTR mode is encrypted?
I referred to the explanation of encryption mode from Wikipedia, but I'm confused now, and I went to find some books about Cryptography, but it didn't solve my confusion.
The CTR mode uses Counter to ...
- 127
0
votes
1
answer
74
views
If encrypting with a hash function in counter mode, will the security of this scheme be at most minimal{input,output}?
It's possible to use a hash function as an encipherment scheme if used in counter mode.
Let's suppose I take a 64-bytes (512-bits) seed/key and hash it concatenated with counters, and use it as a ...
- 393
2
votes
1
answer
120
views
Is a naive 27bit FPE algorithm using AES-CTR insecure?
I don't have a deep mathematical background in cryptography. I am reading "The FFX Mode of Operation for Format-Preserving Encryption". Section D says the following.
Why feistel? The ...
- 123
1
vote
1
answer
94
views
In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?
Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation.
Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
- 393
0
votes
1
answer
62
views
Clarification regarding AES-CTR
I was recently trying to perform a AES-128 CTR Encryption and Decryption.
I had a observation that if a AES-CTR encrypted value is encrypted again (with same key and Iv) it results in the plain text ...
- 1
2
votes
1
answer
85
views
When the input size in a PRF is larger than the output and many inputs will generate the same output, but why AES-256 in CTR mode is considered safe?
I know that if the input size in a pseurandom-function is larger than its output, many different inputs will generate the same output by the Pigeonhole principle (I also read an article related to ...
- 393
0
votes
0
answers
119
views
Problem in matching AES CTR encryption and decryption with two different engines
I have a problem in combining encryption with a host software tool based on LibTomCrypt sources, then decryption with the hardware BEE (Bus Encryption Engine) of an i.MX RT1062 NXP processor. I am ...
- 137
0
votes
1
answer
69
views
Use same key k in deterministic counter mode to encrypt two different plaintext
What goes wrong if we use the same key k in deterministic counter mode to encrypt two different plaintext messages m0 /= m1.
It is not true that c0 = c1, because we XOR output of m0 with input of m1 ...
- 183
1
vote
0
answers
33
views
CCM in the RUP setting reduced to CTR?
I have a question regarding the paper:
Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014
(DOI: 10.1007/978-3-662-45611-8_6)
AE schemes such as GCM [28] and ...
- 143
1
vote
1
answer
177
views
Is there a standard way of scrambling the output of AES?
So I needed symmetric encryption for my program. I landed on AES 192 bits in the CTR mode, because of some Computerphile videos on YouTube.
After using it with the Node.js "crypto" lib ...
3
votes
2
answers
394
views
Why the polynomial of GCM is primitive?
I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$
This polynomial is Primitive (in $\mathbb{F}_2$).
What is the interest of choosing a primitive polynomial and not a simple ...
- 2,595
0
votes
2
answers
2k
views
Why GCM is used more often than CTR?
I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used?
What is the advantage to use the GCM instead of using the Counter-mode?
- 2,595
1
vote
1
answer
63
views
Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?
A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
- 877
0
votes
1
answer
199
views
AES-CTR: using the same key and IV with unique messages
I have short (8-byte) messages which are effectively true random numbers, and I want to encrypt these messages with a (pre-shared) key....
I'm using AES-CTR for this purpose -- but with the SAME IV ...
- 123
8
votes
1
answer
1k
views
Would an encryption-only block cipher be useful at all?
I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.
...
- 1,247
0
votes
1
answer
97
views
Reduce AES-CTR malleability impact by shuffling plain text
I need to cipher and decipher text with randomly access. For this I decided to use AES in CTR mode which is a good compromise between CBC and GCM.
But CTR mode is malleable. It is not a big problem ...
0
votes
0
answers
84
views
Is it safe to use CTR + HMAC with the same key when the key is unique for each message?
Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
- 101
1
vote
1
answer
122
views
Is it safe to "compress" an IV in AES256-CTR? [closed]
Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
user80785
0
votes
0
answers
66
views
Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret
I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
- 877
1
vote
0
answers
127
views
Show that block cipher with CTR is a good PRNG
Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG.
Counter mode works as follows:
$Y_i = Enc_k(IV + f(i))$
$C_i = Y_i \bigoplus P_i = Y_i \...
- 123
0
votes
0
answers
99
views
0
votes
0
answers
159
views
what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?
So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
- 1
1
vote
1
answer
496
views
Performance of AES CTR + HMAC SHA1
I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that.
I run multiple tests with <...
- 115
0
votes
1
answer
194
views
CTR HMAC SHA1 vs GCM Key management
The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1.
For my thesis I want to research if GCM would be a better option.
Therefore I read following discussion.
There the answer was that GCM ...
- 115
1
vote
1
answer
736
views
Is AES GCM without GMAC vulnerable against known plaintext attack?
Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
- 1,497
2
votes
2
answers
567
views
Does keeping IV secret increase security of CTR mode?
Let's suppose I encrypt something with CTR mode and keep the key and IV secret.
Does keeping the IV secret together with the key increase strength of encryption?
- 877
3
votes
2
answers
3k
views
Proper use of AES CTR
I've read that AES CTR is only safe if used properly. Therefore, I want to be sure that I use it properly.
The initial vector (IV) can only be used once, it doesn't have to be random. Is it secure to ...
- 33
0
votes
1
answer
142
views
CTR and OFB block cipher modes and their post-quantum security. Some questions [duplicate]
It's said that quantum computers can break block ciphers with 2^(n/2) queries (being n the key size).
I read this paper: https://eprint.iacr.org/2016/197
It says that CTR and OFB modes are safe ...
- 877
1
vote
0
answers
578
views
Size of the counter in CTR mode
If I understood it correctly, in CTR mode I encrypt the nonce or IV together with the counter as a block, which is then XORed with the plaintext. For the next block, I increment the counter. Is there ...
- 37
2
votes
3
answers
1k
views
What does counter mean in Counter (CTR) Mode? Is it the same as nonce?
As asked above, what does "counter" mean exactly? Is it the same as nonce?
Also, the book Network Security Essentials (6ed.) from William Stallings states, "Typically the counter is ...
0
votes
1
answer
262
views
How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?
In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general.
I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
- 159
1
vote
1
answer
348
views
How is WinZip AES different from normal AES
I'm trying to write a function in dart that can can decrypt a file inside a zip that is encrypted using the WinZip AES-256 standard. Documentation I have found here: https://www.winzip.com/en/support/...
- 13
1
vote
0
answers
74
views
CTR mode calculate messages before new key is required
I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR).
I have just two simple questions:
At around 4:30 in the video they show 2^48 without saying where ...
- 145
2
votes
1
answer
348
views
CTR overlap with random IV
Problem:
I'm slightly worried about counter repeats in CTR mode when using random IV.
If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
- 1,649
1
vote
1
answer
2k
views
How to use nonce, counter, and IV in AES-256-CTR?
preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.
how do i construct a valid IV, given a nonce? What does this have to do ...
- 11
2
votes
1
answer
428
views
Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?
Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext.
The ...
- 918
1
vote
2
answers
110
views
Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]
Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size.
...
- 113
0
votes
0
answers
248
views
Simple XOR cipher with pseudo random plain text of arbitrary length
We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
- 601
1
vote
0
answers
126
views
Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?
Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs.
Will I get 512 bits of encryption strength?
- 877
2
votes
1
answer
712
views
Comparing the security when using fixed IV for CBC and CTR
Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
1
answer
480
views
CTR block generation
From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my ...
- 449
0
votes
1
answer
196
views
Brute force strategy
I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption.
Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
- 1
2
votes
1
answer
323
views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
- 123