1
$\begingroup$

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.

how do i construct a valid IV, given a nonce? What does this have to do with a counter?

im doing 2-way communication with a bluetooth module (it is the server to my phone's client) and its data is encrypted using AES-256-CTR with a 32B key and a 128-bit (16B) counter. after successful login, i am given the 32B key and a 96-bit (12B) nonce.

the lib i use for decryption requires an IV. i don't fully understand what it is, but i've tried concatenating the 12B nonce with '00 00 00 01' (hex) to make the counter, and use that as the IV. no dice.

how i'm testing, is i'm going through the module's API to relay "hello world" via bluetooth from the server. the client receives an encrypted string as expected, but the same "hello world" is encrypted into something different each time.

more details available if needed!

Improve this question
$\endgroup$
4
  • $\begingroup$ IV is just another word for nonce in CTR. $\endgroup$
    – forest ♦
    Jun 7, 2021 at 22:12
  • $\begingroup$ @forest Usually the nonce is smaller than the IV; it only consist of the higher order bits. Having a random nonce the size of the full counter makes no sense because you may need to encrypt fewer bits to run into a collision. If the last part is all zero bits then at least you know the amount of space between two subsequent nonces. $\endgroup$
    – Maarten Bodewes ♦
    Jun 7, 2021 at 22:17
  • $\begingroup$ @MaartenBodewes I've always heard the two being interchangeable, unless you're talking about the actual input to the block cipher itself rather than parameters to the block cipher in CTR mode? $\endgroup$
    – forest ♦
    Jun 7, 2021 at 22:34
  • $\begingroup$ @forest actually, NIST calls them only counter-block, page 16 and also see 19 and $\endgroup$
    – kelalaka
    Jun 8, 2021 at 9:20

1 Answer 1

Reset to default
3
$\begingroup$

how do i construct a valid IV, given a nonce? What does this have to do with a counter?

You may not expect this, but it depends; multiple schemes are equally secure (e.g. big endian vs little endian). Generally though the counter value is a 128 bit unsigned big endian integer. The nonce is the most significant (leftmost) part of that integer.

Furthermore, the initial low part of the counter would start at (all) zero - not one as in your example.

So you'd have:

NNNNNNNN NNNNNNNN NNNNNNNN 00000000

as starting value (as hexadecimals, where N represents some hex digit of the nonce), where the left is the most significant part. Of course this is the case with a 96 bit nonce and a 32 bit counter. This starting value is commonly called the IV.

As the size of the nonce may vary many libraries, usually the increase of the counter is done modulus $2^{128}$, with the disadvantage that an overflow in the lowest 32 bit will affect the nonce. It is usually up to the user of the AES library to test this (but you'd need $2^{32} * 16 = 64 \text{GiB}$ or almost $69 \text{GB}$ to get there).

but the same "hello world" is encrypted into something different each time

Yeah, so most likely the nonce changes every time. Either that or the key changes, or even both the key and the nonce.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.