Is CTR more secure than CBC?

Question

In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide information security such as confidentiality or authenticity. A block cipher by itself is only suitable for the secure cryptographic transformation (encryption or decryption) of one fixed-length group of bits called a block. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block.

• Most modes require a unique binary sequence, often called an initialization vector (IV), for each encryption operation.
• The IV has to be non-repeating and, for some modes, random as well.
• The initialization vector is used to ensure distinct ciphertexts are produced even when the same plaintext is encrypted multiple times independently with the same key.[6]
• Block ciphers may be capable of operating on more than one block size, but during transformation, the block size is always fixed.
• Block cipher modes operate on whole blocks and require that the last part of the data be padded to a full block if it is smaller than the current block size.
• There are, however, modes that do not require padding because they effectively use a block cipher as a stream cipher.

Historically, encryption modes have been studied extensively in regard to their error propagation properties under various scenarios of data modification. Later development regarded integrity protection as an entirely separate cryptographic goal. Some modern modes of operation combine confidentiality and authenticity in an efficient way, and are known as authenticated encryption modes.

Answer 1

Is CTR more secure than CBC?

CTR

Your obligations for CTR mode

1. You must generate a uniform random 256-bit secret key, and keep it secret all the time;
2. For each message that is going to be encrypted under the same key choose an Initialization Vector (IV) that must be unique i.e. the (key,IV) pair never repeats. You can send the IV prepended to the ciphertext.
3. The message size must not exceed $2^{64}$ if you use AES (PRP) instead of a PRF where CTR is designed for PRF.

In return: CTR guarantees

1. CPA security; that is the adversary cannot distinguish two ciphertexts with the same length, and thus cannot read the message sent.

   That is all you get from the CTR mode if used properly. To achieve authenticated encryption use HMAC with CTR in encrypt-than-MAC as a recommendation. In modern Cryptography, we have AES-GCM mode that provides confidentiality, integrity, and authentication. This is still applicable to (key,IV) reuse problem. The nonce misuse resistant schemes like AES-GCM-SIV are advised.

CBC

Your obligations for CBC mode

1. You must Generate a uniform random 256-bit secret key, and keep it secret all the time;
2. For each message that is going to be encrypted under the same key choose an Initialization Vector (IV) that must be unique and unpredictable. You can send the IV prepended to the ciphertext
3. Make sure that the message size is multiple of 128 with proper padding.
4. The message size must not exceed $2^{60}$.
5. The key must not be used more than $2^{45}$ due to the IV collision due to the birthday attack. This will produce $$(2^{45})^2/2^{128}/2 = 2^{90 - 128-1} = 1/2^{39}$$ probability of collision instead of $1/2$ probability of $2^{64}$

In return : CBC guarantees

1. CPA security; that is the adversary cannot distinguish two ciphertexts with the same length, and thus cannot read the message sent.

   That is all you get from the CBC mode if used properly. To achieve authenticated encryption use HMAC with CBC in encrypt-than-MAC as a recommendation.

   TLS 1.3 left the CBC mode, actually, all of the 5 modes of operations on the TLS 1.3 are Authenticated Encryption modes.

Pros and Cons

• The IV reuse is catastrophic in CTR mode that can remove the confidentiality ( not the key since CPA secure), in CBC mode it may leak information on the first block.
• CTR mode doesn't need padding at all whereas CBC mode requires padding at this is vulnerable to padding oracle attacks, that work as a decryption oracle. On that at rest, this is not a problem.
• Both modes don't have integrity, and therefore bit flipping attacks are possible. CTR is more vulnerable than CBC since for some part of the message the bit flipping attack produces garbage.
• CTR mode provides full random encrypt/decrypt operations, CBC mode encryption is sequential, decryption can be random with two ciphertexts per block.
• CTR also can precompute the stream that helps pre-computation, CBC cannot.

A little conclusion

Security is considered according to the attack model. Both algorithms are archaic mode of operations that we don't use them anymore since they cannot provide security mode than CPA. CBC mode is almost left and the CTR mode exists in the authenticated encryption modes like AES-GCM, ChaCha20-Poly1305, and not used alone. While there is no direct conclusion without the attack model, In modern cryptography we prefer the Authenticated encryption modes > Ind-CCA.

Answer 2

Neither mode provides authentication, so in that sense they are both not very secure. CBC has more error propagation obviously, but as the last paragraph of the quote in the question states, error propagation is mostly ignored by now.

CBC requires an unpredictable IV (for the attacker), while CTR mode just requires a nonce. However CBC fails less dramatically if the IV is repeated or when too many data packets are encrypted.

CBC is vulnerable against padding oracle attacks in the correct setting, which makes the mode more vulnerable (if you count padding as part of the mode). However, both are vulnerable against plaintext oracles, and CTR mode then allows each bit to be changed individually, which is just as dangerous in my opinion.

So in the end, which one is more secure depends on how the mode is used. Both can be used to create a secure system by providing confidentiality. CTR has more practical benefits in the end (parallelism, nonce), which is likely why it is ending up as underlying encryption scheme for authenticated modes such as CCM, GCM and EAX.

Answer 3

Comparison: CTR vs CBC

	CBC	CTR MODE
uses	PRP	PRF
parallel processing	NO	YES
Security of rand. enc.	q^2L^2 << |x|	q^2L << |x|
dummy padding block	Yes	No
1 byte msgs (none-based)	16x expansion	no expansion

It is possible to solve a dummy padding block using ciphertext stealing for CBC

An attack on CBC with rand. IV

CBC where attacker can predict the IV is not CPA-secure !!

Suppose given c <-- E(k,m) can predict IV for next message

Bug in SSL/TLS 1.0: IV for record #i is last CT block of record #(i-1)