Questions tagged [ctr]
Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.
256
questions
0
votes
1
answer
42
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 103
1
vote
2
answers
257
views
Encrypting random IV in CTR mode (no nonce!)
Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
- 323
1
vote
1
answer
71
views
How CTR mode is encrypted?
I referred to the explanation of encryption mode from Wikipedia, but I'm confused now, and I went to find some books about Cryptography, but it didn't solve my confusion.
The CTR mode uses Counter to ...
- 129
0
votes
1
answer
67
views
If encrypting with a hash function in counter mode, will the security of this scheme be at most minimal{input,output}?
It's possible to use a hash function as an encipherment scheme if used in counter mode.
Let's suppose I take a 64-bytes (512-bits) seed/key and hash it concatenated with counters, and use it as a ...
- 379
2
votes
1
answer
92
views
Is a naive 27bit FPE algorithm using AES-CTR insecure?
I don't have a deep mathematical background in cryptography. I am reading "The FFX Mode of Operation for Format-Preserving Encryption". Section D says the following.
Why feistel? The ...
- 123
1
vote
1
answer
67
views
In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?
Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation.
Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
- 379
0
votes
1
answer
56
views
Clarification regarding AES-CTR
I was recently trying to perform a AES-128 CTR Encryption and Decryption.
I had a observation that if a AES-CTR encrypted value is encrypted again (with same key and Iv) it results in the plain text ...
- 1
2
votes
1
answer
74
views
When the input size in a PRF is larger than the output and many inputs will generate the same output, but why AES-256 in CTR mode is considered safe?
I know that if the input size in a pseurandom-function is larger than its output, many different inputs will generate the same output by the Pigeonhole principle (I also read an article related to ...
- 379
0
votes
0
answers
83
views
Problem in matching AES CTR encryption and decryption with two different engines
I have a problem in combining encryption with a host software tool based on LibTomCrypt sources, then decryption with the hardware BEE (Bus Encryption Engine) of an i.MX RT1062 NXP processor. I am ...
- 137
0
votes
1
answer
47
views
Use same key k in deterministic counter mode to encrypt two different plaintext
What goes wrong if we use the same key k in deterministic counter mode to encrypt two different plaintext messages m0 /= m1.
It is not true that c0 = c1, because we XOR output of m0 with input of m1 ...
- 185
1
vote
0
answers
28
views
CCM in the RUP setting reduced to CTR?
I have a question regarding the paper:
Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014
(DOI: 10.1007/978-3-662-45611-8_6)
AE schemes such as GCM [28] and ...
- 143
1
vote
1
answer
147
views
Is there a standard way of scrambling the output of AES?
So I needed symmetric encryption for my program. I landed on AES 192 bits in the CTR mode, because of some Computerphile videos on YouTube.
After using it with the Node.js "crypto" lib ...
3
votes
2
answers
379
views
Why the polynomial of GCM is primitive?
I'm interested on the polynomial used in GCM-mode : $X^{128}+X^7+X^2+X+1$
This polynomial is Primitive (in $\mathbb{F}_2$).
What is the interest of choosing a primitive polynomial and not a simple ...
- 2,554
0
votes
2
answers
528
views
Why GCM is used more often than CTR?
I've seen (on Wikipedia) in the more recent version of TLS, the Counter-mode was not used. But the Galois-Counter-mode was used?
What is the advantage to use the GCM instead of using the Counter-mode?
- 2,554
1
vote
1
answer
58
views
Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?
A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
- 867
0
votes
1
answer
146
views
AES-CTR: using the same key and IV with unique messages
I have short (8-byte) messages which are effectively true random numbers, and I want to encrypt these messages with a (pre-shared) key....
I'm using AES-CTR for this purpose -- but with the SAME IV ...
- 23
8
votes
1
answer
1k
views
Would an encryption-only block cipher be useful at all?
I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.
...
- 1,247
0
votes
1
answer
71
views
Reduce AES-CTR malleability impact by shuffling plain text
I need to cipher and decipher text with randomly access. For this I decided to use AES in CTR mode which is a good compromise between CBC and GCM.
But CTR mode is malleable. It is not a big problem ...
0
votes
0
answers
54
views
Is it safe to use CTR + HMAC with the same key when the key is unique for each message?
Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
- 101
1
vote
1
answer
113
views
Is it safe to "compress" an IV in AES256-CTR? [closed]
Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
- 315
0
votes
0
answers
62
views
Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret
I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
- 867
1
vote
0
answers
119
views
Show that block cipher with CTR is a good PRNG
Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG.
Counter mode works as follows:
$Y_i = Enc_k(IV + f(i))$
$C_i = Y_i \bigoplus P_i = Y_i \...
- 123
0
votes
0
answers
81
views
0
votes
0
answers
146
views
what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?
So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
- 1
1
vote
1
answer
374
views
Performance of AES CTR + HMAC SHA1
I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that.
I run multiple tests with <...
- 115
0
votes
1
answer
153
views
CTR HMAC SHA1 vs GCM Key management
The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1.
For my thesis I want to research if GCM would be a better option.
Therefore I read following discussion.
There the answer was that GCM ...
- 115
1
vote
1
answer
589
views
Is AES GCM without GMAC vulnerable against known plaintext attack?
Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
- 1,477
2
votes
2
answers
481
views
Does keeping IV secret increase security of CTR mode?
Let's suppose I encrypt something with CTR mode and keep the key and IV secret.
Does keeping the IV secret together with the key increase strength of encryption?
- 867
3
votes
2
answers
2k
views
Proper use of AES CTR
I've read that AES CTR is only safe if used properly. Therefore, I want to be sure that I use it properly.
The initial vector (IV) can only be used once, it doesn't have to be random. Is it secure to ...
- 33
0
votes
1
answer
115
views
CTR and OFB block cipher modes and their post-quantum security. Some questions [duplicate]
It's said that quantum computers can break block ciphers with 2^(n/2) queries (being n the key size).
I read this paper: https://eprint.iacr.org/2016/197
It says that CTR and OFB modes are safe ...
- 867
1
vote
0
answers
460
views
Size of the counter in CTR mode
If I understood it correctly, in CTR mode I encrypt the nonce or IV together with the counter as a block, which is then XORed with the plaintext. For the next block, I increment the counter. Is there ...
- 37
2
votes
3
answers
904
views
What does counter mean in Counter (CTR) Mode? Is it the same as nonce?
As asked above, what does "counter" mean exactly? Is it the same as nonce?
Also, the book Network Security Essentials (6ed.) from William Stallings states, "Typically the counter is ...
0
votes
1
answer
217
views
How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?
In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general.
I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
- 125
1
vote
1
answer
255
views
How is WinZip AES different from normal AES
I'm trying to write a function in dart that can can decrypt a file inside a zip that is encrypted using the WinZip AES-256 standard. Documentation I have found here: https://www.winzip.com/en/support/...
- 13
1
vote
0
answers
72
views
CTR mode calculate messages before new key is required
I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR).
I have just two simple questions:
At around 4:30 in the video they show 2^48 without saying where ...
- 145
2
votes
1
answer
321
views
CTR overlap with random IV
Problem:
I'm slightly worried about counter repeats in CTR mode when using random IV.
If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
- 1,507
1
vote
1
answer
1k
views
How to use nonce, counter, and IV in AES-256-CTR?
preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.
how do i construct a valid IV, given a nonce? What does this have to do ...
- 11
2
votes
1
answer
357
views
Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?
Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext.
The ...
- 835
1
vote
2
answers
89
views
Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]
Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size.
...
- 113
0
votes
0
answers
199
views
Simple XOR cipher with pseudo random plain text of arbitrary length
We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
- 561
1
vote
0
answers
107
views
Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?
Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs.
Will I get 512 bits of encryption strength?
- 867
2
votes
1
answer
567
views
Comparing the security when using fixed IV for CBC and CTR
Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
1
answer
357
views
CTR block generation
From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my ...
- 421
0
votes
1
answer
135
views
Brute force strategy
I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption.
Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
- 1
2
votes
1
answer
275
views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
- 123
2
votes
1
answer
146
views
Cryptography Engineering - Design Principles and Practical Applications - Chapter 9 Generating Randomness - Section 9.4 The Generator
I'm currently reading "Cryptography Engineering - Design Principles and Practical Applications" written by "Niels Ferguson, Bruce Schneier, Tadayoshi Kohno" published by Wiley in ...
3
votes
1
answer
1k
views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
- 165
2
votes
1
answer
589
views
AES256 CTR nonce generation
I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can ...
- 45
3
votes
2
answers
337
views
How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?
I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
- 207
2
votes
2
answers
412
views
With AES-CTR does the block input need to be implemented as nonce || counter?
I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
- 179