Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret key along with the IV after generation, and the resulting byte array is sent to the receiver side in secure manner.
Is it practical to create a 32 byte array such that the first 16 byte is used to store the secret key and the last 16 byte is to store the IV and send the result to the receiver side?
It doesn't make too much sense at all to send the IV together with the key. The whole idea of an IV is that it is unique per key. But if the key changes value each time, then any IV is unique.
So you could use a static IV or even an IV that consists of all zeros. In that case you only need to worry that you don't reuse the key at other locations in the protocol. For instance for CTR mode, you should not use a Key Check Value that is generated by encrypting a block consisting of all zero's, as it would leak the initial block of the resulting key stream.
It's not a good idea to perform operations with the key to derive an IV though. If you need a separate key and IV from a given secret, please use a KBKDF such as HKDF to separately calculate the key and IV from the secret.
If your key is not changing despite the protocol given above then just prefix a unique (cryptographically safe random) IV to the ciphertext. This should also be the fail-safe default. Using an authenticated cipher like GCM or EAX should also be considered.
Edit
Sending the secret value to the other side over a secure channel is usually not a good idea. Session keys should be established beforehand, preferably by using a key agreement algorithm to provide forward security. Sending the key over a secure channel sounds easy, but if you already have a secure channel, you don't need a session key to establish a new one.
Normally you would e.g. prepend the IV to the cipher text as fgrieu suggested. But it would also be fine to send the IV together with the secret key in case they are bound to message sent.
You would normally use prepending when sending several messages with the same key but of course different IVs. Thus the key has to be send securely only once whereas you do not need additional protection for the IV.
But keep in mind NEVER to reuse an IV with the same key when encrypting different messages!
