I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC.
Is reusing the same key several times dangerous in AES-CBC mode? Does the use of a random IV preclude all possible attacks in such cases?
Key/IV pairs should not be reused for either AES-CTR and AES-CBC - or for any other symmetric cipher for that matter. As a cipher is a Pseudo Random Permutation (PRP) inserting the same input will result in identical output. If a key/IV pair is reused then information is leaked to an attacker; the attacker can distinguish data with the same contents.
CTR is a streaming mode for block ciphers. In AES-CTR the key stream depends only on the key and the IV, not the plaintext. This key stream is XOR-red with the plaintext. It is possible to find additional information about the plaintext in addition to the issue above; if the key and a counter value are reused then the XOR of two ciphertexts is identical to the XOR of the plaintexts. So the key would still be safe, but the plaintext can be easily retrieved.
Reusing the key for any cipher should be no issue as long as the IV is unique - up to the specified amount of plaintext that the cipher can handle, usually a very large amount. In the case of CTR the IV should be unique enough to make sure that the counter does not repeat. Please read into CTR mode to see what that means when generating an IV. Make sure that it is understood what IV/nonce means for the specific application of CTR; the terms can be mixed up and may be used differently for specific protocols and implementations.
For CBC there are additional constraints: information about the IV should not be available in advance to an attacker that can alter the plaintext (chosen plaintext attack or CPA). Using a 16 byte value that is indistinguishable from random to an attacker should indeed preclude any attacks on the block cipher mode. That IV may simply be prefixed to the ciphertext in plain. If an authentication tag is used over the ciphertext then the IV must however be included in the calculation of the authentication tag (e.g. HMAC value).
