# the counter mode of encryption CTR - AES [closed]

To attack an encryption algorithm, you ask the encryption oracle to encrypt a polynomial number of messages of your choice and observe the outputs. Then, you give the oracle two messages m0 and m1. The oracle will choose one of the messages uniformly at random, encrypts it, and return the ciphertext c to you. The encryption algorithm is said to be broken if you can determine to which one of the two messages the ciphertext corresponds. Assuming the counter is 48-bit long and the used block cipher is AES (recall that AES operates on 128-bit blocks) answer the following questions:

a. Assume the counter is always zero (i.e., the counter does not change from block to block). Can you come up with a successful attack against this mode of encryption?

b. Assume now the nonce is fixed (i.e., the nonce does not change from message to message). Can you come up with a successful attack against this mode of encryption?

c. What is the maximum length of the messages that can be encrypted using this mode?

d. In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key?

• Posting hw questions here is a waste of your time, our time, and your lecturer's time. – redplum Mar 10 '18 at 0:48
• I see your homework/assignment, but I can't detect your question. Therefore, it's unclear what you are asking. What research have you done? What have you tried? Where exactly did you get stuck solving this? Please edit your question accordingly. I'll be happy to reopen it once you do. – e-sushi Mar 10 '18 at 1:23
• I copied the whole question. – AFB Mar 10 '18 at 11:52
• @AFB "This is not a homework solving service. What have you tried? What do you not understand about these questions?" – cypherfox Mar 10 '18 at 12:10
• @AFB You indeed copied the whole question/assignment/homework (nothing really new there), but you still fail to describe your own question related to it. This results in the question still being off-topic as it’s still unclear what you are asking (and not the person who wrote the question/assignment/homework you are quoting). Again – What research have you done? What have you tried? Where exactly did you get stuck solving this? Please edit your question accordingly to pull this on-topic. One thing is clear: no one will do your work and solve the quoted assignment/homework for you. – e-sushi Mar 10 '18 at 12:14

Your questions were directly copied form a text book. This is not a homework solving service. The following hints should help you understand the questions. What have you tried? What do you not understand about these questions?

a. Assume the counter is always zero (i.e., the counter does not change from block to block). Can you come up with a successful attack against this mode of encryption?

CTR with a fixed counter is worse than ECB. Penguins anyone?

b. Assume now the nonce is fixed (i.e., the nonce does not change from message to message). Can you come up with a successful attack against this mode of encryption?

Key-nonce reuse is critical. Especially with a stream cipher like AES-CTR. What happens when you use a one-time pad twice?

c. What is the maximum length of the messages that can be encrypted using this mode?

How large is a single block?

How many blocks can a block cipher in counter mode produce?

d. In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key?

How many different nonces are there?

• ‘CTR’ with a fixed counter is not ~ECB—it's much worse than that. $\operatorname{AES-ECB}_k(a \mathbin\Vert b) = \operatorname{AES}_k(a) \mathbin\Vert \operatorname{AES}_k(b)$, but $\operatorname{AES-CTRLOLWUPS}_k(a \mathbin\Vert b) = (a \oplus p) \mathbin\Vert (b \oplus p)$, where $p = \operatorname{AES}_k(0)$. – Squeamish Ossifrage Mar 9 '18 at 20:32
• @SqueamishOssifrage Er yes of course. – cypherfox Mar 9 '18 at 22:43
• I think c is the maximum message size of 2^32 blocks but I am not sure – AFB Mar 10 '18 at 6:43
• about d .. the number of messages encrypted under a single key is small. but I can not specify a number??? – AFB Mar 10 '18 at 6:44
• Please revise your question with respect to e-sushi's comment on the question. – cypherfox Mar 10 '18 at 7:05