What goes wrong if we use the same key k in deterministic counter mode to encrypt two different plaintext messages m0 /= m1.

It is not true that c0 = c1, because we XOR output of m0 with input of m1 in counter mode. As a result, c0 cannot equal c1, and c1 cannot be said to be the same as c0.

Could this be true?

Attacker find two c0 and c1, then find m0 and m1.

Currently, attackers can check all new messages they send or receive. He found the key using ciphertext and plaintext.

  • 1
    $\begingroup$ Is this homework? If you're asking because you're thinking of doing this in practice, well, don't do that $\endgroup$
    – poncho
    Jan 13, 2023 at 20:39
  • $\begingroup$ Yes, but I'l final exam start about 9hours ago. I need last true answer. $\endgroup$ Jan 13, 2023 at 20:44
  • $\begingroup$ Are you using a different nonce? $\endgroup$
    – forest
    Jan 14, 2023 at 4:17
  • $\begingroup$ @forest yes, using diffrent nonce. $\endgroup$ Jan 14, 2023 at 11:27
  • $\begingroup$ @forest yes, using diffrent nonce. $\endgroup$ Jan 14, 2023 at 11:27

1 Answer 1


This is a homework question; by policy, we don't give the final answer to homework questions - you learn better if you figure the answer out yourself.

That said, we will give hints - here are a couple:

  • If we have $C_0 = P_0 \oplus AESCTR_{key}$ and $C_1 = P_1 \oplus AESCRT_{key}$, how are $C_0$ and $C_1$ related?

  • If we can deduce $P_0 \oplus P_1$, can we use that to recover $P_0, P_1$? Actually, that depends on the distribution that $P_0, P_1$ are drawn from - for some common distributions (e.g. ASCII English) we can.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.