As far as I know, AES-CTR depends on nonce. If I will use same key and nonce for encrypting 1 block of data and another - it will be unsecure. So, how can I encrypt a huge block of data (about 1GB) using AES-CTR?

  • $\begingroup$ Cna you exess the $2^{128}$ limit for one key $\endgroup$
    – kelalaka
    Feb 11 '20 at 18:02
  • $\begingroup$ does it mean that using ctr mode i can encrypt different blocks using same key and nonce? $\endgroup$
    – veter0
    Feb 11 '20 at 18:22
  • $\begingroup$ You can continue encrypting new files just where you left in the counter. $\endgroup$
    – kelalaka
    Feb 11 '20 at 18:23

So, how can I encrypt a huge block of data (about 1GB) using AES-CTR?

So CTR-mode works as follows $C=P\oplus E_K(N)$ where $P,C$ are the plain- and ciphertext respectively and $E_K(N)$ is the encryption of $N$ under the key $K$ for every plaintext and ciphertext block.

Now if you were to re-use a $(N,K)$ pair this would indeed break security. This is why normally in CTR-mode to encrypt block $i$ we apply some function $f(N,i)$ to our nonce, for example $f(N,i)=N+i$ or $f(N,i)=N\|i$ ($\|$ denoting concatenation here) so we get different values for each block.

Of course you can't always maintain a global state value $i$ which is why for each new message $N$ or point where you don't to carry around $i$ you either derive a new $N$ from some contextual information (e.g. a packet counter) such that the $f(N,i)$ are unlikely to overlap or you choose a random $N$ and transmit it along.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.