Why must IV/key-pairs not be reused in CTR mode?

Question

Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation so far as to why this is the case.

The issue is obvious if the attacker can manage to obtain the plain text and its corresponding cipher text for one piece of the data - but if no known plain texts are available, how could an attacker reconstruct the key-stream from just the IV value?

Can the security issues be mitigated by keeping the IV secret too? E.g. would an attacker have any realistic chance of cracking the encryption by just knowing that key/IV-pairs have been reused in the creation of two different ciphertexts, but nothing more?

Answer 1

Yes, the attacker would have a realistic chance of recovering plaintext, and preventing him from knowing the IV values does not reduce this risk.

The problem is that CTR mode encryption is effectively:

$C = P \oplus F(Key, IV)$

where $P$ is the plaintext, $C$ is the ciphertext, and $F$ is a complex function of its two inputs.

The problem with this is if you encrypt two different plaintexts with the same $Key$, $IV$ values, then the attacker gets two pairs:

$C_1 = P_1 \oplus F(Key, IV)$

$C_2 = P_2 \oplus F(Key, IV)$

Where he can see the values $C_1$, $C_2$. With those, he can then compute:

$C_1 \oplus C_2 = P_1 \oplus P_2$

and thus deriving the value of the two plaintexts exclusive-or'ed together.

As for how that can be attacked, well, you can find two examples against ASCII-English plaintexts here and here.

And, note that since the attacker didn't actually use the IV value, it doesn't matter to him whether he knows it or not.