# Use same key k in deterministic counter mode to encrypt two different plaintext

What goes wrong if we use the same key k in deterministic counter mode to encrypt two different plaintext messages m0 /= m1.

It is not true that c0 = c1, because we XOR output of m0 with input of m1 in counter mode. As a result, c0 cannot equal c1, and c1 cannot be said to be the same as c0.

Could this be true?

Attacker find two c0 and c1, then find m0 and m1.

Currently, attackers can check all new messages they send or receive. He found the key using ciphertext and plaintext.

• Is this homework? If you're asking because you're thinking of doing this in practice, well, don't do that Commented Jan 13, 2023 at 20:39
• Yes, but I'l final exam start about 9hours ago. I need last true answer. Commented Jan 13, 2023 at 20:44
• Are you using a different nonce? Commented Jan 14, 2023 at 4:17
• @forest yes, using diffrent nonce. Commented Jan 14, 2023 at 11:27
• @forest yes, using diffrent nonce. Commented Jan 14, 2023 at 11:27

• If we have $$C_0 = P_0 \oplus AESCTR_{key}$$ and $$C_1 = P_1 \oplus AESCRT_{key}$$, how are $$C_0$$ and $$C_1$$ related?
• If we can deduce $$P_0 \oplus P_1$$, can we use that to recover $$P_0, P_1$$? Actually, that depends on the distribution that $$P_0, P_1$$ are drawn from - for some common distributions (e.g. ASCII English) we can.