Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
0 votes
1 answer
238 views

Encrypting the nonce in AES-CCM

I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
byte-carlton's user avatar
0 votes
0 answers
67 views

Exposing the vulnerability of CTR mode of operation

In the CTR mode of operation, the plaintext block is treated as a stream cipher, where each byte of the plaintext gets XOR-ed with each byte of the key (which is generated using a nonce and a counter) ...
Abhinav Tahlani's user avatar
3 votes
2 answers
383 views

What input parameters can be made public in the AES-CTR mode?

Preface: I am beginner of cryptography and not native English speaker. So I may make terrible mistake (about grammar and cryptography). I understand that the parameters used for AES-CTR are "key&...
kaki's user avatar
  • 31
0 votes
0 answers
39 views

Using a hash instead of AES-CTR before XORing a plaintext [duplicate]

In AES-CTR, a key, a nonce and a counter are all encrypted to produce a value that is then XORed with a plaintext to produce the ciphertext. Let's say we were to make a hash out of the key, the nonce ...
BillTheKid's user avatar
1 vote
2 answers
3k views

How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?

Respected community, I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker. Is it easy ...
Aravind A's user avatar
  • 1,020
0 votes
1 answer
93 views

Key expansion in AES CTR mode

While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption). Does AES CTR mode also requires such a step ? Or can the 256 ...
shaiko's user avatar
  • 103
1 vote
2 answers
333 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
ManRow's user avatar
  • 343
1 vote
1 answer
189 views

How CTR mode is encrypted?

I referred to the explanation of encryption mode from Wikipedia, but I'm confused now, and I went to find some books about Cryptography, but it didn't solve my confusion. The CTR mode uses Counter to ...
S-N's user avatar
  • 127
0 votes
1 answer
74 views

If encrypting with a hash function in counter mode, will the security of this scheme be at most minimal{input,output}?

It's possible to use a hash function as an encipherment scheme if used in counter mode. Let's suppose I take a 64-bytes (512-bits) seed/key and hash it concatenated with counters, and use it as a ...
alpominth's user avatar
  • 393
2 votes
1 answer
120 views

Is a naive 27bit FPE algorithm using AES-CTR insecure?

I don't have a deep mathematical background in cryptography. I am reading "The FFX Mode of Operation for Format-Preserving Encryption". Section D says the following. Why feistel? The ...
relent95's user avatar
  • 123
1 vote
1 answer
94 views

In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?

Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation. Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
alpominth's user avatar
  • 393
0 votes
1 answer
62 views

Clarification regarding AES-CTR

I was recently trying to perform a AES-128 CTR Encryption and Decryption. I had a observation that if a AES-CTR encrypted value is encrypted again (with same key and Iv) it results in the plain text ...
gabbar's user avatar
  • 1
2 votes
1 answer
85 views

When the input size in a PRF is larger than the output and many inputs will generate the same output, but why AES-256 in CTR mode is considered safe?

I know that if the input size in a pseurandom-function is larger than its output, many different inputs will generate the same output by the Pigeonhole principle (I also read an article related to ...
alpominth's user avatar
  • 393
0 votes
0 answers
119 views

Problem in matching AES CTR encryption and decryption with two different engines

I have a problem in combining encryption with a host software tool based on LibTomCrypt sources, then decryption with the hardware BEE (Bus Encryption Engine) of an i.MX RT1062 NXP processor. I am ...
Fabius Wiesner's user avatar
0 votes
1 answer
69 views

Use same key k in deterministic counter mode to encrypt two different plaintext

What goes wrong if we use the same key k in deterministic counter mode to encrypt two different plaintext messages m0 /= m1. It is not true that c0 = c1, because we XOR output of m0 with input of m1 ...
Amirhossein's user avatar
1 vote
0 answers
33 views

CCM in the RUP setting reduced to CTR?

I have a question regarding the paper: Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014 (DOI: 10.1007/978-3-662-45611-8_6) AE schemes such as GCM [28] and ...
kaiya's user avatar
  • 143
1 vote
1 answer
177 views

Is there a standard way of scrambling the output of AES?

So I needed symmetric encryption for my program. I landed on AES 192 bits in the CTR mode, because of some Computerphile videos on YouTube. After using it with the Node.js "crypto" lib ...
Rolands Laucis's user avatar
3 votes
2 answers
394 views

Why the polynomial of GCM is primitive?

I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$ This polynomial is Primitive (in $\mathbb{F}_2$). What is the interest of choosing a primitive polynomial and not a simple ...
Ievgeni's user avatar
  • 2,595
0 votes
2 answers
2k views

Why GCM is used more often than CTR?

I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used? What is the advantage to use the GCM instead of using the Counter-mode?
Ievgeni's user avatar
  • 2,595
1 vote
1 answer
63 views

Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?

A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
phantomcraft's user avatar
0 votes
1 answer
199 views

AES-CTR: using the same key and IV with unique messages

I have short (8-byte) messages which are effectively true random numbers, and I want to encrypt these messages with a (pre-shared) key.... I'm using AES-CTR for this purpose -- but with the SAME IV ...
biosbob's user avatar
  • 123
8 votes
1 answer
1k views

Would an encryption-only block cipher be useful at all?

I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB. ...
juhist's user avatar
  • 1,247
0 votes
1 answer
97 views

Reduce AES-CTR malleability impact by shuffling plain text

I need to cipher and decipher text with randomly access. For this I decided to use AES in CTR mode which is a good compromise between CBC and GCM. But CTR mode is malleable. It is not a big problem ...
Callimard's user avatar
0 votes
0 answers
84 views

Is it safe to use CTR + HMAC with the same key when the key is unique for each message?

Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
g00dds's user avatar
  • 101
1 vote
1 answer
122 views

Is it safe to "compress" an IV in AES256-CTR? [closed]

Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
user avatar
0 votes
0 answers
66 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
phantomcraft's user avatar
1 vote
0 answers
127 views

Show that block cipher with CTR is a good PRNG

Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG. Counter mode works as follows: $Y_i = Enc_k(IV + f(i))$ $C_i = Y_i \bigoplus P_i = Y_i \...
Awerde's user avatar
  • 123
0 votes
0 answers
99 views

Is Using HMAC-SHA256(key, counter) For Providing Pad Only Vulnerable To Bruteforce?

...
user avatar
0 votes
0 answers
159 views

what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?

So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
user0623's user avatar
1 vote
1 answer
496 views

Performance of AES CTR + HMAC SHA1

I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that. I run multiple tests with <...
Soteri's user avatar
  • 115
0 votes
1 answer
194 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
Soteri's user avatar
  • 115
1 vote
1 answer
736 views

Is AES GCM without GMAC vulnerable against known plaintext attack?

Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
MichaelW's user avatar
  • 1,497
2 votes
2 answers
567 views

Does keeping IV secret increase security of CTR mode?

Let's suppose I encrypt something with CTR mode and keep the key and IV secret. Does keeping the IV secret together with the key increase strength of encryption?
phantomcraft's user avatar
3 votes
2 answers
3k views

Proper use of AES CTR

I've read that AES CTR is only safe if used properly. Therefore, I want to be sure that I use it properly. The initial vector (IV) can only be used once, it doesn't have to be random. Is it secure to ...
SOSO30's user avatar
  • 33
0 votes
1 answer
142 views

CTR and OFB block cipher modes and their post-quantum security. Some questions [duplicate]

It's said that quantum computers can break block ciphers with 2^(n/2) queries (being n the key size). I read this paper: https://eprint.iacr.org/2016/197 It says that CTR and OFB modes are safe ...
phantomcraft's user avatar
1 vote
0 answers
578 views

Size of the counter in CTR mode

If I understood it correctly, in CTR mode I encrypt the nonce or IV together with the counter as a block, which is then XORed with the plaintext. For the next block, I increment the counter. Is there ...
Luqus's user avatar
  • 37
2 votes
3 answers
1k views

What does counter mean in Counter (CTR) Mode? Is it the same as nonce?

As asked above, what does "counter" mean exactly? Is it the same as nonce? Also, the book Network Security Essentials (6ed.) from William Stallings states, "Typically the counter is ...
Baldovín Cadena Mejía's user avatar
0 votes
1 answer
262 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
Hern's user avatar
  • 159
1 vote
1 answer
348 views

How is WinZip AES different from normal AES

I'm trying to write a function in dart that can can decrypt a file inside a zip that is encrypted using the WinZip AES-256 standard. Documentation I have found here: https://www.winzip.com/en/support/...
Mark's user avatar
  • 13
1 vote
0 answers
74 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
questioner's user avatar
2 votes
1 answer
348 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
LightBit's user avatar
  • 1,649
1 vote
1 answer
2k views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
jared chong's user avatar
2 votes
1 answer
428 views

Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?

Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext. The ...
fadedbee's user avatar
  • 918
1 vote
2 answers
110 views

Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]

Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size. ...
xnor's user avatar
  • 113
0 votes
0 answers
248 views

Simple XOR cipher with pseudo random plain text of arbitrary length

We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
Manish Adhikari's user avatar
1 vote
0 answers
126 views

Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs. Will I get 512 bits of encryption strength?
phantomcraft's user avatar
2 votes
1 answer
712 views

Comparing the security when using fixed IV for CBC and CTR

Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
imageprocessingproblem's user avatar
1 vote
1 answer
481 views

CTR block generation

From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my ...
Evan Su's user avatar
  • 449
0 votes
1 answer
196 views

Brute force strategy

I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption. Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
anon's user avatar
  • 1
2 votes
1 answer
323 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
Zixradoom's user avatar
  • 123

1
2 3 4 5 6