As far as I know, AES-CTR depends on nonce. If I will use same key and nonce for encrypting 1 block of data and another - it will be unsecure. So, how can I encrypt a huge block of data (about 1GB) using AES-CTR?
3
-
$\begingroup$ Cna you exess the $2^{128}$ limit for one key $\endgroup$– kelalakaCommented Feb 11, 2020 at 18:02
-
$\begingroup$ does it mean that using ctr mode i can encrypt different blocks using same key and nonce? $\endgroup$– veter0Commented Feb 11, 2020 at 18:22
-
$\begingroup$ You can continue encrypting new files just where you left in the counter. $\endgroup$– kelalakaCommented Feb 11, 2020 at 18:23
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
So, how can I encrypt a huge block of data (about 1GB) using AES-CTR?
So CTR-mode works as follows $C=P\oplus E_K(N)$ where $P,C$ are the plain- and ciphertext respectively and $E_K(N)$ is the encryption of $N$ under the key $K$ for every plaintext and ciphertext block.
Now if you were to re-use a $(N,K)$ pair this would indeed break security. This is why normally in CTR-mode to encrypt block $i$ we apply some function $f(N,i)$ to our nonce, for example $f(N,i)=N+i$ or $f(N,i)=N\|i$ ($\|$ denoting concatenation here) so we get different values for each block.
Of course you can't always maintain a global state value $i$ which is why for each new message $N$ or point where you don't to carry around $i$ you either derive a new $N$ from some contextual information (e.g. a packet counter) such that the $f(N,i)$ are unlikely to overlap or you choose a random $N$ and transmit it along.
