As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so:
_______________ | | | | nonce | i | |_______|_______| | _______V_______ | | | block cipher | key -->| (encryption) | |_______________| | V plaintext --->(+)---> ciphertext
But by turning it to a stream cipher, one must be very careful not to reuse a nonce. It seems like it would be safer to do it like this:
_______________ | | | | nonce | i | |_______|_______| | plaintext --->(+) | _______V_______ | | | block cipher | key -->| (encryption) | |_______________| | \---> ciphertext
While it still would be unwise to reuse a nonce, it seems like the effects would be less devastating if it were misused in this way. I see one main disadvantage, and that's that with the first formulation, only the encryption part of the block cipher need to be implemented, whereas with this second formulation, both encryption and decryption need to be implemented.
My questions are:
- Does this latter mode of operation have a name?
- Are there any obvious weaknesses in this latter mode?
- Are there any other reasons why CTR is defined the first way?