I'm using a 64-bit nonce (incremented between the streams) and a 64-bit counter (incremented within a stream) for AES in CTR mode. How many different key streams can I produce with this setup?

  • 1
    $\begingroup$ Do you mean how many different keystreams or how many bits (or bytes) in a single keystream (for a fixed nonce and key)? $\endgroup$ – mikeazo Jul 31 '12 at 13:05
  • $\begingroup$ how many different keystreams $\endgroup$ – goldroger Jul 31 '12 at 13:37
  • 1
    $\begingroup$ Is the key fixed? Is the nonce incremented for each stream, or does it get chosen randomly? $\endgroup$ – CodesInChaos Jul 31 '12 at 14:11
  • $\begingroup$ @CodesInChaos, the key is fixed, the nonce incremented for each stream.. ex: this is my nonce = aaaaaaaaaaaaaaaa this is the counter = 0000000000000001 in the next stream the counter will increment, 0000000000000002 $\endgroup$ – goldroger Jul 31 '12 at 14:41

The number of different key streams depends on the keysize used and the number of bits in the nonce. Say you are using an $n$ bit key and $k$ bits for your nonce. Then the theoretical maximum number of keystreams is $2^n\cdot 2^k=2^{n+k}$ since each combination of nonce and key should result in a different keystream.

If you limit the length of your keystreams, however, this changes. Say you only want $128$-bit keystreams, but you use a $256$-bit key and a $64$-bit nonce. There will only be $2^{128}$ different key streams.

So, if your keystreams are $s$ bits long, you use an $n$ bit key, and a $k$ bit nonce, then really, the number of possible key streams is $\min(2^{s}, 2^{n+k})=2^{\min(s,n+k)}$.

Based on the comment that the key is fixed, this changes the analysis. Since there is only one key it becomes $\min(2^{s}, 2^{k})=2^{\min(s,k)}$. The above analysis if for a randomly chosen key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.