Skip to main content
added 309 characters in body
Source Link
Ilmari Karonen
  • 46.5k
  • 5
  • 111
  • 187

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.

The only (absolutely vital!) requirement for these modes is that the IVs (and for CTR mode, all other counter values used during the encryption process) must be unique. As far as I know, it's perfectly safe to maintain a single running counter for CTR encryption over multiple message, or to feed the last block of an OFB keystream once more through the cipher to generate the IV for the next message.

I don't believe CFB mode is affected, either, since the IV is passed through the block cipher before being combined with the plaintext. Indeed, for the first block of the message, CFB, OFB and CTR modes are all identical: they all compute the first block as ciphertext = plaintextEnc(IV).

The PCBC mode is affected, however, since it is identical to CBC mode for the first block of the message. So is any other mode which encrypts the first block as ciphertext = Enc(plaintextIV).

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.

The only (absolutely vital!) requirement for these modes is that the IVs (and for CTR mode, all other counter values used during the encryption process) must be unique. As far as I know, it's perfectly safe to maintain a single running counter for CTR encryption over multiple message, or to feed the last block of an OFB keystream once more through the cipher to generate the IV for the next message.

The PCBC mode is affected, however, since it is identical to CBC mode for the first block of the message.

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.

The only (absolutely vital!) requirement for these modes is that the IVs (and for CTR mode, all other counter values used during the encryption process) must be unique. As far as I know, it's perfectly safe to maintain a single running counter for CTR encryption over multiple message, or to feed the last block of an OFB keystream once more through the cipher to generate the IV for the next message.

I don't believe CFB mode is affected, either, since the IV is passed through the block cipher before being combined with the plaintext. Indeed, for the first block of the message, CFB, OFB and CTR modes are all identical: they all compute the first block as ciphertext = plaintextEnc(IV).

The PCBC mode is affected, however, since it is identical to CBC mode for the first block of the message. So is any other mode which encrypts the first block as ciphertext = Enc(plaintextIV).

added 406 characters in body
Source Link
Ilmari Karonen
  • 46.5k
  • 5
  • 111
  • 187

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.

The only (absolutely vital!) requirement for these modes is that the IVs (and for CTR mode, all other counter values used during the encryption process) must be unique. As far as I know, it's perfectly safe to maintain a single running counter for CTR encryption over multiple message, or to feed the last block of an OFB keystream once more through the cipher to generate the IV for the next message.

The PCBC mode is affected, however, since it is identical to CBC mode for the first block of the message.

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.

The only (absolutely vital!) requirement for these modes is that the IVs (and for CTR mode, all other counter values used during the encryption process) must be unique. As far as I know, it's perfectly safe to maintain a single running counter for CTR encryption over multiple message, or to feed the last block of an OFB keystream once more through the cipher to generate the IV for the next message.

The PCBC mode is affected, however, since it is identical to CBC mode for the first block of the message.

Source Link
Ilmari Karonen
  • 46.5k
  • 5
  • 111
  • 187

I'm pretty sure at least the CTR and OFB modes are not affected: they simply use the block cipher as a keystream generator for a synchronous stream cipher, and, importantly, the generated keystream is not affected by the plaintext in any way.