4
$\begingroup$

As far as I understand:

  • The primary disadvantage associated with stream ciphers is the need for a random and unique key for each run in order to protect against reused-key attacks.
  • OFB/CFB/CTR block cipher modes turn the cipher into a stream cipher. Again, the IV/nonce should be random and unique.

What's the advantage of using the aforementioned block cipher modes over using a regular stream cipher (even though the latter would probably be faster)?

|improve this question
$\endgroup$
  • $\begingroup$ CTR has one big advantage: It allows random access $\endgroup$ – CodesInChaos Aug 19 '14 at 11:27
4
$\begingroup$

There is no real advantage, other than the fact that it allows you to convert a block cipher into a stream cipher securely. Since there has been a large amount of research put into block ciphers and ciphers such as AES are commonly implemented in hardware (such as AES-NI), it allows for reuse of the primitives.

Side note: the nonce generally does not need to be random to be secure, it just needs to be unique. Since it will be irreversibly and unpredictably permuted by the block cipher it can be predictable unlike an IV, but a nonce reuse is significantly more devastating than an IV reuse.

|improve this answer
$\endgroup$
  • 2
    $\begingroup$ "Side note: the nonce generally does not need to be random to be secure, it just needs to be unique" - Side Note #2: This depends on the mode of operation (and yes it does hold in this case) $\endgroup$ – Cryptographeur May 29 '14 at 8:33
  • $\begingroup$ Side Note #3: CTR mode is extremely sensitive to how you choose the IV. $\endgroup$ – K.G. May 29 '14 at 9:56
  • 1
    $\begingroup$ @K.G. - how so? Just a simple counter will do. $\endgroup$ – hunter May 29 '14 at 10:21
  • $\begingroup$ As additional background, when these modes were initially specified, there weren't really any good, widely accepted stream ciphers, and that continued to be the case until relatively recently. $\endgroup$ – otus May 29 '14 at 12:08
  • $\begingroup$ @hunter I think he means it's extremely sensitive in that a accidentally reused nonce is way way worse than a reused IV $\endgroup$ – Iburi Noc May 30 '14 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.