Tag Info

New answers tagged


Assuming CTR mode is used properly (in particular, neither $IV_1$ nor $IV_2$ is a prefix of the other, which if they're the same length just means they're different), knowing $(M_2,C_2)$ does not help an attacker find $M_1$. Vulnerability to such an attack would imply vulnerability to a chosen plaintext attack; instead, CTR has the IND-CPA property, which ...


This all depends on the IVs. If they are independently generated, the IVs will not only be different (so $IV_1 \neq IV_2$), but also their sequences will not overlap with overwhelming probability. In that case, then everything should be fine, so $C_2 = E(K,(nonce,IV_2))$, and $C_1 = M_1 \oplus E(K,(nonce,IV_1))$. However, if they are reused (so $IV_1 = ...

Top 50 recent answers are included