4
$\begingroup$

Is there any specific method to use AES-256-CTR correctly? I heard a Playstation 3 security vulnerability was exploited due to a CTR error. I would like to avoid this.

How Do I Use AES-256-CTR Correctly?

Currently I am using PHP with OpenSSL. I have a key specified as well as the contents of the unencrypted data but I feel there is something else I should add. If it makes a difference, the key and the data will be different each time.

$\endgroup$
  • 2
    $\begingroup$ CTR mode requires a nonce/IV. How are you generating and using that? $\endgroup$ – mikeazo May 17 '17 at 19:55
  • $\begingroup$ @mikeazo I am not as I do not know how to add that using openssl. $\endgroup$ – rE bOot May 17 '17 at 20:23
  • 4
    $\begingroup$ PS3 was hacked due to poor ECDSA usage, not CTR. CTR is secure when used properly, just as ECDSA. $\endgroup$ – axapaxa May 17 '17 at 21:36
  • $\begingroup$ @mikeazo Not if the key is different each time (as specified in the question), then you might just start at zero. $\endgroup$ – Maarten Bodewes May 17 '17 at 22:25
  • $\begingroup$ @MaartenBodewes, very true. I have seen it a number of times where someone claimed though that the key is never repeated, when in fact, it was. So I just wanted to make sure since the OP didn't even mention the nonce/IV. $\endgroup$ – mikeazo May 17 '17 at 23:40
4
$\begingroup$

Use the PHP libsodium extension or the PHP encryption library. Both are high-quality libraries that provide well-documented functions that allow you to do what you need. They also includes automatic integrity check (this is crucial!), and their operations are protected against timing attacks.

AES256-CTR provides only unauthenticated encryption, which is almost never what you want. You need authenticated encryption.

The libsodium extension has the advantage of being faster in most cases, but it depends on an extension module written in C, so it might not be available everywhere. php-encryption is slower, but it only uses PHP’s built-in OpenSSL binding, so it runs everywhere.

Note that nonces must never be loaded from disk and then used for encryption. It’s way too easy to have a collision that way. Instead, you should generate a fresh encryption key from a master key each time your program starts (using a KDF and some secure random bytes.)

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.