2
$\begingroup$

AES-CTR is not considered as a CSPRNG, why ? Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system such as keys and IVs.

$\endgroup$
1
3
$\begingroup$

AES-CTR is not considered as a CSPRNG, why?

I don't know why this was given as a negative.

AES-CTR can certainly used to generate a pseudo random stream of values. If that alone makes it a CSPRNG is up for debate if you ask me. For instance, the DRBG's specified by NIST all provide a reseeding operation, which is missing from AES-CTR. Although they do provide a counter based operation as well, AES-CTR clearly doesn't qualify.

Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system such as keys and IVs.

It is probably not insecure, but it seems to me that you are not in need of a CSPRNG. It seems to me that you need a key derivation method. Now Argon2id is already that, so if you just need more data then you can just ask Argon2 for it. It can generate up to over 4 billion bytes ($2^{32}$), which should be plenty.

If you need multiple keys derived by sequence, I'd recommend to use a Key Based Key Derivation Function such as HKDF afterwards, using a label or indeed counter to generate multiple keys. Or you could use a ratchet or similar methods of key derivation.


A practical reason not to specify to use a CSPRNG is that the output of CSPRNG is generally just not precisely defined. The output must be pseudo-random of course, but slight changes in the implementation will generate random but different output even for the same seed. It is often not entirely clear if and when a reseed happens either. In that sense the output of a stream cipher such as AES-CTR is probably better defined in practice.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.