Tag Info

Hot answers tagged


I would like to ask if that is true for every AES CTR mode implementation?, Doesn't have to be. You can store the nonce anywhere. You could even send it to the recipient via a different channel (e.g., email the ciphertext and use SMS to transmit the nonce). Storing it at the beginning has its advantages. For example, if streaming the data, you can ...


If you want strict indistinguishability, then yes, you need to store the IV (initial counter) somewhere. However, there are some relaxed modes that are used in practice for things like disk encryption, where it is often very useful to decrypt things "in the middle" like you say. For instance, XEX uses a counter which is derived from the sector and offset ...


Like the other answers say, it does not always have to be the case. One other case where it is often not stored is when you have a single use key, for example as part of some hybrid encryption scheme. Then there is no need to use a nonce at all and it is usually taken to have zero value.


If you start with a random key and zero counter, there's 128 bits of entropy in the system state. If you start with a random key and random counter value, there's 256 bits of entropy. Whether that matters depends on what you are using the PRNG output for. If you are using the output for anything where 256 bits of entropy would be an asset – say random ...


When using counter mode you can start at any value, it doesn't matter. The only important thing is that you never use the same counter value twice for the lifetime of the key. So, as long as your key is actually random and, as you say, you don't use it for more than 1 MB of data, then your generator should be fine.

Only top voted, non community-wiki answers of a minimum length are eligible