3
$\begingroup$

I'm using AES128-CTR for generating pseudo-random values, which is considered secure for up to 1MB (at least from what I've read).

I simply encrypt a 128-bit little-endian counter, starting from 0.

Should I use an IV? Should I start counting from a non-zero random value? Does it make any practical difference?

$\endgroup$
1
  • 1
    $\begingroup$ To have a complete view, you should tell us what do you use as key, how your entropy input is used, if/how do you update your state after the generation, etc. $\endgroup$ – Ruggero Oct 8 '14 at 11:33
3
$\begingroup$

When using counter mode you can start at any value, it doesn't matter. The only important thing is that you never use the same counter value twice for the lifetime of the key. So, as long as your key is actually random and, as you say, you don't use it for more than 1 MB of data, then your generator should be fine.

$\endgroup$
1
$\begingroup$

If you start with a random key and zero counter, there's 128 bits of entropy in the system state. If you start with a random key and random counter value, there's 256 bits of entropy.

Whether that matters depends on what you are using the PRNG output for. If you are using the output for anything where 256 bits of entropy would be an asset – say random 256-bit UUIDs (with some coming from another PRNG instance) – then you could seed the counter with a random value as well. Provided you have sufficient entropy for seeding, of course.

CTR_DRBG in SP 800-90A (pdf) is a ready made PRNG design based on AES CTR with the choices for this kind of thing, as well as key rotation, already sussed out. So you may want to consider using it.

$\endgroup$
4
  • 1
    $\begingroup$ How does the amount of entropy matter at all? If your key is large enough that an attacker cannot break the security of your cipher, then the output of the PRNG will be indistinguishable from a full entropy source. Either you can break it or you can't, I don't see how adding a random IV gives you anything. It can add to your security, but that is an independent consideration. Whatever you want to output, whether it be 128-bit strings or 256-bit strings, the required entropy is not effected at all. $\endgroup$ – Travis Mayberry Oct 8 '14 at 14:01
  • $\begingroup$ I think you are confusing that with the fact that using 128-bit AES has only 64-bits of collision resistance. Choosing two keys and computing $AES_r(0)$ of them still has $2^{-128}$ probability of colliding. But after $2^{64}$ keys, you will likely have a collision. Again though, changing the counter does nothing to help the situation. $\endgroup$ – Travis Mayberry Oct 8 '14 at 16:16
  • 1
    $\begingroup$ Right but my point was that a random counter doesn't change your collision resistance. It is strictly a function of the output size. All it does it add to the complexity of brute force attacks, which the key size should be sufficient to defend against anyway. You can't get 256-bits of collision resistance with only 256-bits of output, and you wouldn't want to because it would make your output distribution easily distinguishable from true random, which actually should have some collisions. $\endgroup$ – Travis Mayberry Oct 8 '14 at 17:32
  • $\begingroup$ @TravisMayberry, yes it does. With zero IV there are $2^{128}$ initial outputs, each of the form $AES_k(0)||AES_k(1)$. With a random initial IV there are (about) $2^{256}$, of the form $AES_k(r)||AES_k(r+1)$. If you generate more than one output with each PRNG instance you have more than $2^{128}$ possible outputs, but you if you generate 1 MB per initialization that's just a few extra bits of output space. It's not 256 bits of entropy so it doesn't have the full collision resistance you'd expect from 256-bit values. $\endgroup$ – otus Oct 8 '14 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.