Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue?

I know that in CTR mode, same key-iv pairs would lead to two-time-pad. But the above construction will not have the same keys.

In application:

Let's say Alice and Bob communicate through TCP. They agreed on using AES-CTR. For each connection, they randomly generate a key but always use a static IV.

(BTW, all encrypted data will be HMACed)


If you assume AES is a pseudo-random permutation(which is pretty much necessary for it to be secure), then yes. However, it's way easier to just use a random IV/noce and keep the keys. Your new key must be distributed to both parties secretly, the IV/nonce can be public, so you can just send it (HMACed of course) in the clear. You obviously can't do this with a key and you may introduce problems depending on how you try to send it.

Typically the IV in CTR mode is called a nonce (shot for number used once). The reason for this is that it, unlike most uses of an IV, need not be random, just only used once. Since we assume the block cipher is a pseudo-random function, we just need to ensure it doesn't get the same value feed into it twice and it will giving us random looking output. Strictly speaking, we just care that the same (Nonce,counter) pair is not used twice, but since we have no control over the counter value, we make sure the nonce is unique.enter image description here.

Assuming that the block cipher is a pseudo random permutation also tells us we only care if the same (key,nonce, counter) is used. Effectively, the key is just selecting at random the permutation we use from the set of all permutations of a given length( the cipher's block size). For each permutation, the output on (nonce,counter) is unique, so we don't care about repeats under different keys.

| improve this answer | |
  • $\begingroup$ For secure network protocols you typically run an ephemeral key-exchange at the beginning, so you end up with a unique master key in any case. So using nonce=0 is actually a bit easier, but generating a random nonce is very easy as well. $\endgroup$ – CodesInChaos Apr 29 '13 at 10:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.