# Do I need an IV to use AES-CTR as a CSPRNG?

I'm using AES128-CTR for generating pseudo-random values, which is considered secure for up to 1MB (at least from what I've read).

I simply encrypt a 128-bit little-endian counter, starting from 0.

Should I use an IV? Should I start counting from a non-zero random value? Does it make any practical difference?

• To have a complete view, you should tell us what do you use as key, how your entropy input is used, if/how do you update your state after the generation, etc. – Ruggero Oct 8 '14 at 11:33

• I think you are confusing that with the fact that using 128-bit AES has only 64-bits of collision resistance. Choosing two keys and computing $AES_r(0)$ of them still has $2^{-128}$ probability of colliding. But after $2^{64}$ keys, you will likely have a collision. Again though, changing the counter does nothing to help the situation. – Travis Mayberry Oct 8 '14 at 16:16
• @TravisMayberry, yes it does. With zero IV there are $2^{128}$ initial outputs, each of the form $AES_k(0)||AES_k(1)$. With a random initial IV there are (about) $2^{256}$, of the form $AES_k(r)||AES_k(r+1)$. If you generate more than one output with each PRNG instance you have more than $2^{128}$ possible outputs, but you if you generate 1 MB per initialization that's just a few extra bits of output space. It's not 256 bits of entropy so it doesn't have the full collision resistance you'd expect from 256-bit values. – otus Oct 8 '14 at 20:55