Hot answers tagged modes-of-operation
Actually, Maarten isn't quite correct; in most cases, the counter doesn't have to be updated in constant time (because it's not secret); however in one case it does: GCM with an IV size that's not 12 bytes. The reason the counter needs to be secret in this case is not because how it is used, but how it is generated. It is initialized to ...
It become a deterministic encryption key: Same message encrypted twice, produces the same ciphertext. This has negative consequences on the security of the cipher, because an adversary know if you encrypt the same message, which means she can distinguish encryptions.
No, the counter does not have to be near constant time as the counter does not have to be secret. Block ciphers are generally resistant against known plain text attacks. Generating a key stream doesn't change that. As you already indicated yourself, the IV does not need to be secret. This means that the counter values won't be secret either. That some ...
Only top voted, non community-wiki answers of a minimum length are eligible