I had a quiz last week in computer security course. There was a confusing question that I am still looking for a good and clear answer.
First, I know that counter mode with a good block cipher is widely accepted and most likely unbreakable as long as the counter (IV) is not being reused.
The question was about using counter mode with a strong block cipher, say AES. The IVs are independently generated. Suppose we encrypt two messages M1 and M2 where M2 is zeros, a sequence of zero bits, and get ciphertexts C1 and C2. Assume C1, M2, C2 are known by an attacker, would it be possible to decrypt, reveal M1?
Since in counter mode C = M ⊕ E(K,(nonce,IV))
for M2, the C2 = E(K,(nonce,IV)) , since M2 is zeros and xoring with zeros does not do anything.
I know that C1 ⊕ C2 = M1 ⊕ M2 but not sure if it is useful here.
My answer was the attacker will not be able to know (M1) because of the strength of the block cipher and the encryption process depends on the key, nonce, and IV which won't be broken if the attacker knows pair of plaintext and it corresponding ciphertext.
I am confused because what I have learned the strength of the counter mode depends on a good block cipher and non-reused IV, but what will happen if the input was zeros, and E(K,(nonce,IV)) was exposed to attacker?
I did not feel I was right, and still confused about it.
Hopefully I can get a clear answer with appreciation.