2
$\begingroup$

It is apparently not good - more precisely it is not secure - to encrypt the same data message M using the same cryptographic K with a block cipher (e.g. AES, but this is not relevant) in both CTR and CBC modes of operation.

One example of this statement can be found in ref. [1] below.

We can assume a context where the attacker has full control on both decryption mechanisms (both the CTR one and the CBC one). Of course, he cannot read or change the key K, but he can inject chosen inputs in both mechanisms and recuperate the outputs. As many as he wants. Secondly, I also assume the attacker know the IV used for CBC, and the [nounce||ctr] in CTR, as these parameters are not secret. Also, to be clear, the IV in CBC mode is not related to the [nounce||ctr] in CTR; it is not the same.

I can imagine that the weakness resides in the capability to decrypt with CTR what was encrypted in CBC (or vice-versa), and somehow gain information from here... But this is too advanced for me.

I am interested in understanding this. How having both encrypted forms bring risks, exposes, the value of K? Or give information that can lead to the clear message?

[1] https://docs.microsoft.com/en-us/playready/packaging/content-encryption-modes#limitations

$\endgroup$
2
  • $\begingroup$ The IV's are the same. Consider only the first block. The documentation doesn't mention about CK! $\endgroup$ – kelalaka Nov 14 '19 at 13:52
  • 1
    $\begingroup$ When the same IV is used, we can distinguish from the first block of ciphertext in both modes if the first block of the common plaintext is all-zero. I don't immediately see an issue if the IVs are chosen independently, and plaintext is independent of previous ciphertext. $\endgroup$ – fgrieu Nov 20 '19 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy