Is regular CTR mode vulnerable to any attacks?

Question

Regular plain CTR mode, is it vulnerable to any attack?

I plan to write a program to encrypt a drive with ctr mode. Would this be wise? Would AES be better?

When I look at this diagram, it looks pretty solid to me.

If the question is "too broad", allow me to rephrase:

Which is better, AES 256 or CTR mode like the picture above to encrypt a drive?

Answer 1

Summing up the discussion in the comments: What you are describing is the CTR Mode of operation of block ciphers, which requires an encryption function ("E" in your diagram) like AES. So, "should I use CTR or AES?" should instead be "should I use AES with CTR or with another mode?"

As @RickyDemers already mentioned, CTR mode (without any additional authentication step) is malleable, which means that it is possible to change the meaning of the ciphertext. For example: you want to encrypt the message $m=01010101$. Counter mode will use the counter and the encryption function to generate a keystream, for example $s=10010110$, and compute the ciphertext

$$c = m \oplus s = 01010101 \oplus 10010110 = 11000011$$

An attacker could now, for example, flip the second bit in the plaintext $m$ by changing $c$ to $c'$:

$$c' = c \oplus 01000000 = 10000011$$

The decryption would use CTR mode to derive the same key stream $s$ as before, but use it to decrypt $c'$, which would result in

$$m' = c' \oplus s = 10000011 \oplus 10010110 = 00010101$$

As you can see, the second bit (which used to be $1$) was changed to $0$ by this change, while leaving the remaining parts of the file data unchanged. This is called malleability.

You can prevent this by using a message authentication system like HMAC or, even better, an authenticated encryption mode like GCM, which functions like CTR mode but also authenticates the data and thereby makes it impossible to change the ciphertext without being detected. Many systems were broken because they did not use any authentication of the ciphertext, and more were broken because they did the authentication wrong.

So, my reply would be:

• Use AES with a sensible mode: XTS or EME if you want to authenticate your data separately using HMAC or something similar, or GCM if you want to do it all at once (I'm not sure if GCM is suitable for full disk encryption though, and be careful when using it, there are some ways to shoot yourself in the foot)
• Also, if this is to be more than an experiment on your part, seriously consider using an established disk encryption tool instead
• Use a cryptographic library instead of writing the encryption code yourself. There are many non-obvious ways to shoot yourself in the foot, and any one of them may be fatal to the security of your system. Established cryptographic libraries have been vetted for these bugs and while they do crop up occasionally, they are much less likely than in any code a single person can write.
• Read and understand this question and all answers in its entirety.
• Your misconception about AES and CTR mode indicates that you are pretty new to the field of cryptography. That's fine, everyone was a novice at some point! But make sure to understand the field a little more before building anything serious, because bugs in cryptography are both hard to find and can be devastating if they occur in software used in practise.