My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce?

key = random;
nonce = 0;

  • 1
    $\begingroup$ To TL;DR the main answer here, both of these options are extremely insecure if the key is ever used to encrypt more than one plaintext. CTR mode (and CTR-based modes like GCM) fail catastrophically in this case. It is a trivial exercise to completely reveal plaintexts encrypted this way. If keys are guaranteed to only ever encrypt one single plaintext, then both schemes (fixed-zero IV and fixed random IV) are equivalent. $\endgroup$ – Stephen Touset Feb 22 '20 at 18:59

There will no problem with using the nonce as 0 but only for once with the same key as the nonce says number used once. Remember we can generate the nonce randomly and at it has $1/2^{128}$ chance to appear.

CTR mode turns a block cipher into a stream cipher. As in all stream cipher, if you use the same stream again it will be vulnerable to crib-dragging attacks. In CTR mode, it is using the same nonce again with the same key.

Never use nonce more than once with the same key. To prevent the reselection of a nonce with a good random number generator, you should stop using the same key much before $\sqrt{2^{128}} = 2^{64}$ nonce generation, that comes from the birthday paradox. Alternatively, you can use an LFSR based solution to generate the nonce deterministically as suggested by the NIST.

so, if I use different keys and zero nonce it will be secure?

With the nonces, you can use the same key for a long time, Using always 0 is no more CTR mode. It is completely a new mode of operation. I don't see a problem with that, except as Maarten commented; the Key Check values:

These are often calculated by performing a single block encryption with all zero's. Please make sure that those are not used or published, or you will be exposing the initial part of your key stream.

It is better to use a HKDF to derive a key and a nonce very easily with your randomly generated key using salt and info


$$\text{HKDF-Extract}(salt, IKM) \to PRK,$$where PRK is a pseudorandom key, IKM is the input key material. If your random source is good, you may not need Extract.



$$\text{KDF-Expand}(PRK, info, L) \to OKM,$$where OKM is Output Keying Material. L is the desired key length.

Note: Rogaway, in their seminal work: Evaluation of Some Blockcipher Modes of Operation, in figure 1.2: summaries of their findings — confidentiality modes. CTR:

An IV-based encryption scheme, the mode achieves indistinguishability from random bits assuming a nonce IV. As a secure nonce-based scheme, the mode can also be used as a probabilistic encryption scheme, with a random IV. Complete failure of privacy if a nonce gets reused on encryption or decryption. The parallelizability of the mode often makes it faster, in some settings much faster, than other confidentiality modes. An important building block for authenticated-encryption schemes 1. Overall, usually the best and most modern way to achieve privacy-only encryption.

Therefore stick the expert's findings!

1 : AES-GCM that uses CTR and Even a single AES-GCM nonce reuse can be catastrophic.

  • $\begingroup$ so, if I use different keys and zero nonce it will be secure? $\endgroup$ – Hersgori Feb 22 '20 at 11:58
  • $\begingroup$ because I use aes-256 for this with 32-bytes key $\endgroup$ – Hersgori Feb 22 '20 at 13:08
  • 2
    $\begingroup$ Only if you use different keys for every plaintext, yes. Honestly though, the consequences of a mistake here are so severe and the benefits in almost all cases so minor that I would virtually never recommend doing this in practice. $\endgroup$ – Stephen Touset Feb 22 '20 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.