1
$\begingroup$

Counter mode uses a counter that is incremented for each block. Doesnt predictability of this counter expose the scheme to attack? I mean if you are incrementing some nonce, then I have a good chance of guessing the next value

$\endgroup$
  • $\begingroup$ If you are really paranoid and have doubts about the block cipher to that effect, despite the design criteria of the cipher to resist those attacks, a dual-ctr stream with independent keys masks the ciphertexts so that key recovery should not be possible (under most conditions) $\endgroup$ – Richie Frame Oct 4 '16 at 0:43
2
$\begingroup$

Modern ciphers are explicitly designed to be resistant to key recovery under known and chosen plaintext attacks. Assuming a successful cipher design, encrypting an incrementing counter does not offer an adversary any advantage in regards to obtaining the key, or predicting future ciphertext blocks.

This could be less true with a weak cipher and/or extremely large numbers of encrypted plaintexts.

$\endgroup$
  • $\begingroup$ why is it then that CBC mode strictly specifies a random IV (sort of a counter that cannot be guessed?). Also, does CTR mode send the initial counter in plain text? -- It seems like this would be the case if guessing the counter is not such a security problem. $\endgroup$ – Minaj Oct 3 '16 at 19:20
  • $\begingroup$ If you use the same IV/key combination twice then security is broken. The IV is normally sent in clear. $\endgroup$ – aventurin Oct 3 '16 at 19:38
  • $\begingroup$ @Minaj CBC and CTR modes work differently and use the IV/nonce for different purposes. This answer touches upon the subject. Note that while an IV should be unpredictable, it is still known to the adversary because it is sent in the clear. The biggest reason why we dont randomly generate nonce is because collisions happen near the birthday bound, which is too probable for even an 128-bit nonce. If you use a 256 bit nonce you can generate it randomly. Nonce reuse in CTR mode reveals the plaintext, IV reuse in CBC leaks whether 2 blocks are the same. $\endgroup$ – Ella Rose Oct 3 '16 at 21:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.