Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

0
votes
1answer
26 views

How many bytes of the last keystream block are used to XOR the final block of partial plaintext in CFB, OFB & CTR modes?

I apologize if this is a dumb question but I'm trying to understand how the final block of partial plaintext is XORed using only n number of bytes in the final keystream block. How do we determine ...
4
votes
1answer
708 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
2
votes
1answer
103 views

Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
0
votes
1answer
87 views

how to compute IV with AES CTR if key, plaintext and ciphertext are known?

Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
3
votes
1answer
333 views

Hashing a counter to prevent distinguishers in CTR mode

Because a block cipher is a PRP and thus bijective, the fact that the input in CTR mode never repeats means that each block of keystream will be unique. This creates a distinguisher from random data ...
0
votes
2answers
154 views

Aes Ctr non-secure PRNG

I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (...
1
vote
1answer
68 views

Strength of Sha512Ctr PRNG

What is the cryptographic strength of sha512ctr when I simply concatenate a counter and 64 bytes from a cryptographic random number generator (in this case RNGCryptoServiceProvider from .net), and ...
3
votes
1answer
169 views

AES-XTS vs AES-CTR for Write Once Storage

I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be ...
2
votes
1answer
51 views

emulating AES GCM with AES CTR

Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it. My question is... what happens ...
1
vote
1answer
84 views

On the probability of a collision in RFO-rCTR

My slides show that assuming a polynomial number $q(n)$ of blocks have been encrypted by a random function oracle in the context of a CPA-game, the probability of having a collision in the input to ...
0
votes
0answers
81 views

Building a CPA-secure sCTR from a PRF

Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$. For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG ...
1
vote
1answer
243 views

Is it possible to do a known-plaintext attack with this set up of AES CTR mode?

Is it possible to perform a known-plaintext attack to extract the key from AES byte encryption? The encryption is setup with the following two lines: ...
2
votes
3answers
122 views

AES-CTR-MAC alternative

I have to send small (~10 bytes) authenticated messages over an insecure channel. I was thinking of an alternative to the "conventional" AES128-CTR-MAC, which will take 16 bytes for the CT and ...
0
votes
1answer
197 views

How is a PRP different from PRF? Both can be inverted to get the same input

PRP is said to be a bijective function which means that there is a one-to-one mapping with the output. And hence the output can be inverted using the decryption algorithm to get the same input. ...
0
votes
1answer
76 views

Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref) Under Known-Issues I found this paragraph: The RLPx ...
0
votes
1answer
161 views

Why is stateful CTR slightly better than stateless CTR? Does the adversary know the value of counter in CTR mode of operation?

This might be a stupid question but is really fundamental in my understanding of CTR (I'm a newbie to cryptography theory). For CPA security, the adversary only knows the IV, and may query the oracle ...
1
vote
1answer
374 views

Does an IV need to be used in AES CTR mode?

If I encrypt a message once using AES CTR, will I need an IV? Additionally, if I do use an IV, will I need to send with with the cipher text?
0
votes
1answer
43 views

IV transmission from Transmitter to Receiver side in CTR mode for every call

I am using block cipher mode (CTR Mode) for the transmission of voice data. Need to know, how can I transfer the same IV at the decryption side (for every call) as the IV for the same packets on ...
0
votes
1answer
76 views

Can we replace IV increasing from addition to XOR in CTR mode?

In CTR mode (not nonce-based), if we have ${IV}\stackrel{\$}{\leftarrow}\{0,1\}^{128}$ and want to encrypt message blocks $M_1, M_2, ..., M_\ell \in\{0,1\}^{128}$: The ciphertext is $IV\parallel C_1\...
4
votes
0answers
175 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
1
vote
0answers
50 views

Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write?

I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file ...
11
votes
2answers
400 views

What are the risks of using CTR mode with 64 bit blocks?

On DJB's blog he writes: I was one of about 40 people sitting in a meeting where the speaker, NSA's Louis Wingers (one of the Simon and Speck authors), falsely claimed that counter mode is safe for ...
1
vote
1answer
60 views

Why do we only encrypt nounce + counter in Counter Mode?

I do not understand, what the advantage is in only encrypting the nonce + Ctr and XORing this to our plaintext, instead of encrypting everything. (If our block cipher can be easily decrypted) What ...
0
votes
1answer
51 views

Why can't we use the IDEA's decryption rule for decrypting a block on CTR mode?

Suppose that a block is ciphered with IDEA using CTR mode operation. To get the original message, why can't we use the cyphered rule?
2
votes
1answer
178 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
1
vote
1answer
32 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
4
votes
2answers
121 views

Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key ...
4
votes
4answers
214 views

Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
-2
votes
2answers
442 views

ciphertext stealing and CTR

Why Does CTR mode encryption not use ciphertext stealing?
4
votes
1answer
321 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
0
votes
1answer
78 views

Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
0
votes
1answer
272 views

AES in CTR mode, with a single key, and an IV derived from the plaintext

We need a system to compare cipher-texts for equality, without (the checking system) having access to the plaintext. We found a library that uses AES in CTR mode, with a single key, and an IV based ...
2
votes
2answers
3k views

How insecure is AES-128-CTR to encrypt any kind of data using the Ethereum keystore file format?

I am using the Ethereum keystore file format to encrypt any other data such a plain text or JSON. Here is an example of pseudocode of the implementation: ...
0
votes
1answer
299 views

Is my AES-128-CTR implementation secure enough to encrypt private keys and mnemonic seed? [closed]

I am building a cryptocurrency wallet online where everything is stored in the browser (No servers). At this moment I am storing all private keys encrypted using AES-128-CTR I've chosen this method ...
2
votes
1answer
104 views

Practical implications of the switching lemma and the counter mode security bound

I have some trouble with determining how many times a key can be safely used when using counter mode encryption. For example: We split the IV into two parts, a message counter (nonce) and a block ...
0
votes
1answer
368 views

how to obtain the plaintext in counter mode using the AES block cipher

I want to obtain the plaintexts. Sentence1 ...
1
vote
0answers
45 views

Upper bound of this derivative of counter mode?

Suppose that: $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$. $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$. $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$. $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$. $E(K, X): \...
1
vote
1answer
233 views

Near in place encryption with BouncyCastle CCM, How large must IV and MAC be?

I need to encrypt 20 bytes of data and the encrypted nonce + data + mac cannot exceed 30 bytes in size. I have an implementation but i'm not sure if i'm cutting too many corners and compromising ...
1
vote
1answer
358 views

Aes 128, CTR mode, Counter Mode, Hmac, mac

Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm. Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-...
1
vote
0answers
75 views

Is there any cipher standard based on SHA-3, where it is not used as part of RFC2104?

I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this: IV|AES-CTR(PLAINTEXT_SIZE|PLAINTEXT|SHA-3(KEY|PLAINTEXT_SIZE|PLAINTEXT)) So, ...
4
votes
1answer
155 views

Why does CTR mode become insecure after $2^{0.5 \times n}$ blocks?

The question is exactly what it says on the tin. If $n$ is the block size in bits of a block cipher, then why does outputting $2^{0.5 \times n}$ block in counter mode become a problem when there is no ...
2
votes
0answers
287 views

Seekable cipher, is AES CTR a good solution?

I'd like to create a simple file-cipher, which provides seekable encryption (so I can decrypt any part of the encrypted message, without the need of decrypt from the start). Here's my current idea: I ...
1
vote
1answer
161 views

How used nonce in CTR Mode of AES-EAX Encryption?

I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
1
vote
1answer
334 views

Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:...
5
votes
2answers
587 views

Security of non-standard use for AES-256-CTR?

I have a string secret that I would like to encrypt for storage in a Yubikey's second slot. These slots can be configured to store up to 38 characters that are later "typed" by the USB device acting ...
2
votes
0answers
188 views

AES-CTR and AES-CMAC using the same temporary key

Is it a severe security issue using a short-lived dynamic key for both AES-CTR and AES-CMAC? CMAC is generated on the cleartext and 32 bit of it are attached to the message (MAC-and-Encrypt) The key ...
4
votes
2answers
640 views

Security of AES in CTR mode with fixed nonce (but different key)

If I am using AES in CTR mode and use a unique key every time but the same nonce, is this secure? If so, does it make a difference if the nonce is public?
0
votes
1answer
158 views

AES-CTR authentication salt+HMAC(ciphertext) OR HMAC(salt+ciphertext)

Which one of these functions are preferred for authenticating AES-CTR? ...
0
votes
1answer
81 views

Arbitrary length to multiple of block size

I would like to apply CTR mode on a arbitrary length which isn't multiple of block size. Is this possible without applying padding. In case we apply padding - how does the decryption algorithm know ...
1
vote
2answers
745 views

CTR Mode and Chosen Plaintext Attacks

P.71 of Cryptography Engineeering states "Any weakness in CTR encryption mode immediately implies a chosen plaintext attack on the block cipher." It seems to me that "any weakness" is vague. I'm not ...