# Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/courses/OnlineCrypto/slides/04-using-block-v2-annotated.pdf, pp. 20), does not have the nonce. It only uses the key and the counter value as the input of the PRF. If I'm not mistaken, we can say that given a PRF $$F$$ and a key $$k$$, a pseudo-random number is generated by $$F(k, g(nonce, counter\_value))$$ in CTR mode, while deterministic counter mode uses simply $$F(k, counter\_value)$$, without the presence of nonce.

According to the slides pp. 21, Deterministic counter mode is already semantically secure. So why do we need a nonce in the standardized CTR mode?

• Aug 11, 2022 at 8:22
• "According to the slides pp. 21, Deterministic counter mode is already semantically secure." You're ignoring the really important condition that the key must be used only once. Sep 10, 2022 at 17:58