0
$\begingroup$

This might be a stupid question but is really fundamental in my understanding of CTR (I'm a newbie to cryptography theory).

For CPA security, the adversary only knows the IV, and may query the oracle for random values of IV+$ctr^*$ where $ctr^*$ is the counter.

For stateful CTR, what do we assume is predictable - the nonce or the counter?

$\endgroup$
2
$\begingroup$

For stateful CTR, what do we assume is predictable - the nonce or the counter?

Both. In general, the majority of implementations work as follows:

The input to the block cipher is the combination of IV/Nonce (96-bits) and Counter (32-bits). For each message, the Nonce increments by 1. For each block of a message, the counter increments by 1.

The state kept by communicating parties consists of the key, the last nonce used, and the last counter used. Importantly, keeping track of these ensures that the combination of all 3 is only ever used once, as repetition can allow plaintext recovery if an attacker knows one of the plaintext blocks used with that triplicate.

That predictability is also important for optimization, as both sender and receiver can precompute blocks of a message in parallel while waiting for the message to be received, or in multiple threads to increase throughput.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.