0
$\begingroup$

What is your opinion on this scheme:

1)get IV from CSPRNG

2)set 3 encryption keys k1,k2,k3 (3*key_lenght) (KDF/PBKDF)

3)Use 3 ciphers in CTR mode like this: The initial IV is encrypted using cipher1 with key k1 , then the iv is incremented and encrypted by using cipher 2 that uses the second key and so on, the output of the respective ciphers is xored with the plaintext to obtain the ciphertext.

Is this secure?

Improve this question
$\endgroup$
10
  • $\begingroup$ you may want to explain that better, I am not sure what you are asking $\endgroup$
    – Richie Frame
    Apr 8, 2014 at 8:12
  • $\begingroup$ If this is a secure mode of operation? Using 3 cipher like this $\endgroup$
    – user1028028
    Apr 8, 2014 at 8:50
  • $\begingroup$ I understand what you want to know, but you have not explained how the operation actually works with enough detail for the question to be answered $\endgroup$
    – Richie Frame
    Apr 8, 2014 at 8:55
  • $\begingroup$ cipher 1 is used with key one to encrypt the IV, this is xored with the first block of plaintext, then cipher 2 is used with key 2 and IV+1, then cipher 3 then back to cipher 1... do you understand this ? $\endgroup$
    – user1028028
    Apr 8, 2014 at 9:01
  • $\begingroup$ Yes.. incrementing the IV for the same block output is unnecessary with different keys $\endgroup$
    – Richie Frame
    Apr 8, 2014 at 9:04

1 Answer 1

Reset to default
1
$\begingroup$

If by "encrypted" you mean generating a keystream, then what you propose is to use in the CTR mode $$ C_i = P_i \oplus F_K(IV||i) $$ the following function $F$: $$ F_{K_1||K_2||K_3} = E_{K_1}\oplus E_{K_2} \oplus E_{K_3}. $$ This is secure as long as you ensure that for each key all the used IVs are different (i.e. are nonces). As mentioned in another comment, it is OK to use the same IV with different keys in the CTR mode.

Improve this answer
$\endgroup$
3
  • $\begingroup$ You misunderstood... they is only one IV, the first cipher encrypts it and xors the result to the first block of plaintext, the second cipher encrypts iv+1 and xors that in the next block of plaintext $\endgroup$
    – user1028028
    Apr 8, 2014 at 10:59
  • $\begingroup$ You mean you use just the $3n$-bit concatenation of three $n$-bit blockciphers? $\endgroup$
    – Dmitry Khovratovich
    Apr 8, 2014 at 12:23
  • $\begingroup$ yes, in essence that's it $\endgroup$
    – user1028028
    Apr 8, 2014 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.