What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?

  • 1
    $\begingroup$ Please show some research effort in your questions.. and they can both be made just as secure if done right. They both have their pros and cons and target different uses. $\endgroup$ – Thomas Jan 19 '13 at 12:19
  • 3
    $\begingroup$ Ok because using CBC mode in SSH and using TLS 1.0 or below should not be used. Of course TLS 1.0 and below should not be used anyway. I am concerned in that I have seen no bugs on OpenSSL for CTR, but several for CBC. I'm wondering if AES-CTR is a better choice with TLSv1.1 and above. openssh.com/txt/cbc.adv kb.cert.org/vuls/id/958563 $\endgroup$ – deb_infosec Sep 29 '16 at 17:40
  • 1
    $\begingroup$ The Q does not specify communications at all much less SSH or SSL/TLS in particular. That SSH "vulnerability" hasn't been heard from again since 2008, and the OpenSSH folks, who are above-averagely aggressive on security, still have AES- and 3DES-CBC enabled (but not preferred) client-side in 7.3. There are no SSL/TLS ciphersuites with AES-CTR (or anything-CTR) as such, but in TLS1.2 (and 1.3 when it arrives) there are AEAD suites using AES-GCM and AES-CCM both of which are based on CTR. (Also Camellia-GCM, but I haven't seen that implemented.) $\endgroup$ – dave_thompson_085 Sep 30 '16 at 11:22

I wrote a rather lengthy answer on another site a few days ago. Bottom-line is that CTR appears to be the "safest" choice, but that does not mean safe. The block cipher mode is only part of the overall protocol. Every mode has its quirks and requires some extra systems in order to use it properly; but in the case of CTR, the design of these extra systems is somewhat easier. For instance, when compared to OFB, there is no risk of a "short cycle" with CTR.

This is why actually usable modes like EAX and GCM internally use CTR.

| improve this answer | |
  • 11
    $\begingroup$ You should make it clearer that he should use EAX or GCM, or encrypt-then-HMAC. CTR or CBC by themselves can be very, very dangerous. $\endgroup$ – Stephen Touset Jan 20 '13 at 1:16
  • 5
    $\begingroup$ CTR mode is also easier to run in parallel on multiple cores, resulting in better performance. $\endgroup$ – r3mainer Sep 29 '16 at 21:55
  • $\begingroup$ Why do you intrigue us so much??? "actually usable models like EAX and GCM"... Thanks for providing linkes though! $\endgroup$ – Paul-Sebastian Manole Jul 22 '19 at 8:46
  • $\begingroup$ @squeamishossifrage, thanks for the quite important tip. Here's a validation reference from Wikipedia stating that CTR mode is well suited to operate on a multi-processor machine where blocks can be encrypted in parallel. If you can include it in your comment, I will delete this comment. $\endgroup$ – Paul-Sebastian Manole Jul 22 '19 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.