Is this correct way to generate stream cipher using AES CTR mode?

Question

We are implementing searchable encryption techniques proposed by Song et al in Java for a paper[1]. The schemes need a Stream Cipher for achieving search over encrypted data. The stream of random bits should be reproducible later while decryption given the same "Seed".

Now we plan to generate the stream of random bits using AES in CTR mode. What we don't understand is what is considered as "seed". Is "seed" the random 64 bits prefix part of the IV / Nonce ?

What would be the plain text CTR mode while generating random stream ? Can we give some hard coded string as plain text as we don't really care what we are encrypting, all we want is random stream of bits that could be reproduced later

Or what is considered a secure way to generate random stream of bits ?

[1] Song, Dawn Xiaoding, David Wagner, and Adrian Perrig. "Practical techniques for searches on encrypted data." Security and Privacy, 2000. S&P 2000. Proceedings. 2000 IEEE Symposium on. IEEE, 2000.

Answer 1

The seed should be the key and the nonce or IV. Those input parameters determine the value of the key stream. Note that the nonce may be implied if the key is not reused, in that case the key may be the only seed, with the nonce having a static value (you should however make sure that you are not vulnerable to multi-target attacks if you use a static IV, see the comment of CodesInChaos below).

For most stream ciphers - such as CTR mode of encryption - the key stream is used to encrypt the plain text by XOR'ing the plain text with the key stream. Obviously if you are just interested in the key stream of N bits then you can simply encrypt a plain text consisting of N bits set to zero (as zero is the identity element for XOR). Depending on the implementation the underlying key stream may also be available directly.