4
$\begingroup$

after reading a lot of stuff about AES CTR and its IV i'm still not sure if it is ok to use a predictable IV or not.

I searched the web and found some programs / devices that use encryption in this way.

For example Lora. Lora is a low speed Network for exchanging data (temperatures or humidity sensors ) over a complete cities with thousands of devices.

Example: I've found source code of the Lora Mac on the Web which is doing exactly that.

A Sequence counter that uses every value only once over the entire Node lifetime.

And a little 1 Byte counter for every new 16 Byte Block.

The IV is Initialized by

static uint8_t aBlock[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};

after this

    aBlock[5] = dir;           ( direction of message)
    aBlock[6] = ( address ) & 0xFF; (Hardware address of device)
    aBlock[7] = ( address >> 8 ) & 0xFF; (Hardware address of device)
    aBlock[8] = ( address >> 16 ) & 0xFF; (Hardware address of device)
    aBlock[9] = ( address >> 24 ) & 0xFF; (Hardware address of device)
    aBlock[10] = ( sequenceCounter ) & 0xFF; (counter that never repeats)
    aBlock[11] = ( sequenceCounter >> 8 ) & 0xFF; (counter that never repeats)
    aBlock[12] = ( sequenceCounter >> 16 ) & 0xFF; (counter that never repeats)
    aBlock[13] = ( sequenceCounter >> 24 ) & 0xFF; (counter that never repeats)
    aBlock[15] = ( ( ctr ) & 0xFF );  ( a counter value that is incremented for every 16 Byte Block)

Is this secure enough?

Source Code: https://github.com/Lora-net/LoRaMac-node/blob/master/src/mac/LoRaMacCrypto.c Line 108: void LoRaMacPayloadEncrypt()

http://www.semtech.com/wireless-rf/internet-of-things/

Improve this question
$\endgroup$
1
  • $\begingroup$ Don't forget to accept an answer once your question has been answered sufficiently (at this point of time the choice is rather limited but you did get an answer from Yehuda :) ) $\endgroup$
    – Maarten Bodewes ♦
    Jan 20, 2017 at 10:29

1 Answer 1

Reset to default
5
$\begingroup$

For CTR mode, a random IV is not needed. The only requirement be that the counter be unique in each block over all encryptions. (This is in contrast to CBC mode where unpredictability of the IV is essential.)

Improve this answer
$\endgroup$
2
  • $\begingroup$ it would be perfectly safe to start an iv at 0? (as long as it is unique) $\endgroup$
    – Bob
    Jan 17, 2017 at 15:14
  • 1
    $\begingroup$ Yes that is true. So, if you are in a session setting with a new key, then you can always start at 0. Having said this, if this turns out to be a multi key setting where many different parties are using many keys in different sessions, then there are advantages to using a random IV. $\endgroup$
    – Yehuda Lindell
    Jan 17, 2017 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.