1
$\begingroup$

As I understand it, CTS pads the last block and swaps it with the second last to compensate for a partial block of data. I have written a DRBG (Deterministic Random Bit Generator) using AES-CBC that only accepts an input size which falls on the block boundary.

Is CTS really necessary here? I can't imagine a way in which it's absence will affect the entropy of the output. Am I understanding this correctly?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ Could you show us the actual DRBG algorithm you've implemented? Normally CTS would not be required, but that depends on the actual algorithm. $\endgroup$ – Maarten Bodewes♦ Jun 3 '14 at 15:40
  • $\begingroup$ The AES class, it's based on mono/bouncycastle with fixed params (256/128) and CBC done in-class. The generator that calls the class creates keys/IV and random start pos for monotonic integer arrays equal to 4Kib. The key/IV/Pos are stored in a key used to generate random data at either end for a Vernam cipher. It's large and complex, just let me know what you want me to post.. $\endgroup$ – JGU Jun 3 '14 at 15:49
  • $\begingroup$ Tried to answer it without additional knowledge. $\endgroup$ – Maarten Bodewes♦ Jun 3 '14 at 16:03
4
$\begingroup$

Normally you don't want to reverse the encryption used within a DRBG. Schemes like PKCS#7 padding and CTS are required to deterministically reverse the padding during decryption. If you just want to have a final block, you should be fine by using zero padding until the end of the block.

Of course, if this zero padding is actually harming the output of your DRBG depends on the algorithm.

|improve this answer
$\endgroup$
  • $\begingroup$ I guess my point was.. it doesn't need any padding, because final block is always a full block. So in this case, where padding is never required, would I even need CTS? I don't think so.. but just double-checking $\endgroup$ – JGU Jun 3 '14 at 16:23
  • 1
    $\begingroup$ For full blocks you don't need to do anything with regards to padding. I don't think CTS will have much influence on the quality of the output though, but in general I would not use it for this kind of purpose. $\endgroup$ – Maarten Bodewes♦ Jun 3 '14 at 20:45
  • $\begingroup$ Thanks owlstead.. I did some more research and moved it to a counter(SIC) implementation.. $\endgroup$ – JGU Jun 3 '14 at 21:44
  • $\begingroup$ Ah, that's more like it. CBC is not the best for this. Note that just using CTR is not enough; if you use CTR mode encryption on static valued blocks you can be certain that no blocks will be repeated. That means you can predict that certain values are not in the following blocks. $\endgroup$ – Maarten Bodewes♦ Jun 3 '14 at 21:48
  • $\begingroup$ Laid out simply.. it is aes ctr encrypting arrays of ascending integers each started at a random position. 1024 * int32 to equal a block of 4096 bytes of random data, then a new key/iv/pos and so on to create a 'pad' file.. does this sound right? $\endgroup$ – JGU Jun 3 '14 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.