Using 0 nonce for AES-256 in CTR mode

Question

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce?

key = random;
nonce = 0;

Answer 1

There will no problem with using the nonce as 0 but only for once with the same key as the nonce says number used once. Remember we can generate the nonce randomly and at it has $1/2^{128}$ chance to appear.

CTR mode turns a block cipher into a stream cipher. As in all stream cipher, if you use the same stream again it will be vulnerable to crib-dragging attacks. In CTR mode, it is using the same nonce again with the same key.

Never use nonce more than once with the same key. To prevent the reselection of a nonce with a good random number generator, you should stop using the same key much before $\sqrt{2^{128}} = 2^{64}$ nonce generation, that comes from the birthday paradox. Alternatively, you can use an LFSR based solution to generate the nonce deterministically as suggested by the NIST.

so, if I use different keys and zero nonce it will be secure?

With the nonces, you can use the same key for a long time, Using always 0 is no more CTR mode. It is completely a new mode of operation. I don't see a problem with that, except as Maarten commented; the Key Check values:

These are often calculated by performing a single block encryption with all zero's. Please make sure that those are not used or published, or you will be exposing the initial part of your key stream.

It is better to use a HKDF to derive a key and a nonce very easily with your randomly generated key using salt and info

Extract:

$$\text{HKDF-Extract}(salt, IKM) \to PRK,$$where PRK is a pseudorandom key, IKM is the input key material. If your random source is good, you may not need Extract.

and

Expand:

$$\text{KDF-Expand}(PRK, info, L) \to OKM,$$where OKM is Output Keying Material. L is the desired key length.

Note: Rogaway, in their seminal work: Evaluation of Some Blockcipher Modes of Operation, in figure 1.2: summaries of their findings — confidentiality modes. CTR:

An IV-based encryption scheme, the mode achieves indistinguishability from random bits assuming a nonce IV. As a secure nonce-based scheme, the mode can also be used as a probabilistic encryption scheme, with a random IV. Complete failure of privacy if a nonce gets reused on encryption or decryption. The parallelizability of the mode often makes it faster, in some settings much faster, than other confidentiality modes. An important building block for authenticated-encryption schemes ¹. Overall, usually the best and most modern way to achieve privacy-only encryption.

Therefore stick the expert's findings!

---

^{1 : AES-GCM that uses CTR and Even a single AES-GCM nonce reuse can be catastrophic.}