Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
0
votes
1answer
33 views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
2
votes
1answer
110 views

Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?

Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext. The ...
1
vote
2answers
50 views

Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]

Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size. ...
0
votes
0answers
47 views

Mismatch between NIST SP800-90A test vectors and CTR_DRBG output

I am testing my Python implementation of NIST SP800-90A CTR_DRBG https://csrc.nist.gov/publications/detail/sp/800-90a/rev-1/final (AES-256, no df) with the CAVP test vectors (https://csrc.nist.gov/...
0
votes
0answers
40 views

Hashing function as a cipher in CTR mode [duplicate]

Can we use hashing function in CTR mode as a cipher? And our key could be a random initialization vector. Are there any practical problems with that idea, that we don't do this?
0
votes
0answers
61 views

Simple XOR cipher with pseudo random plain text of arbitrary length

We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
1
vote
0answers
59 views

Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs. Will I get 512 bits of encryption strength?
0
votes
1answer
75 views

Comparing the security when using fixed IV for CBC and CTR

Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
1answer
104 views

CTR block generation

From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my ...
0
votes
1answer
61 views

Brute force strategy

I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption. Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
2
votes
1answer
102 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
2
votes
1answer
100 views

Cryptography Engineering - Design Principles and Practical Applications - Chapter 9 Generating Randomness - Section 9.4 The Generator

I'm currently reading "Cryptography Engineering - Design Principles and Practical Applications" written by "Niels Ferguson, Bruce Schneier, Tadayoshi Kohno" published by Wiley in ...
3
votes
1answer
214 views

AES CTR: Random IV

I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
1answer
124 views

AES256 CTR nonce generation

I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can ...
3
votes
2answers
105 views

How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?

I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
2
votes
2answers
118 views

With AES-CTR does the block input need to be implemented as nonce || counter?

I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
1
vote
1answer
122 views

AES CTR - Counter Management

Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each). How is the current used IV (nonce+ctr) synchronized among both communicating entities? I suppose that the ...
1
vote
1answer
47 views

Malleability for varying length message

Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $...
2
votes
1answer
95 views

Combining CTR and ECB modes to prevent attacks

In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
0
votes
0answers
36 views

Re-encrypt modified file section with AES-CTR

I am trying to encrypt a file using AES/CTR/NoPadding. The goal is to re-encrypt the new/changed blocks and leave the old ones unchanged then generate a new MAC. My thinking is that when the file ...
3
votes
3answers
340 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
3
votes
0answers
124 views

Is there any real attack deployed on the CTR mode over history?

The CTR mode, with its CPA security, is one of the malleable block cipher mode of operations. An attacker can simply modify the bits of the ciphertext stream in their advance. This is due to the lack ...
10
votes
4answers
3k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
3
votes
1answer
305 views

AES-CTR security if S-boxes substituion is omitted?

I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
1
vote
1answer
69 views

Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?

I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
1
vote
1answer
68 views

What is encrypted with the key to give the keystream in CTR mode exactly?

I'm learning how CTR mode and there is something I have trouble understanding. If I understood correctly, two components are encrypted with the key, a nonce and a counter concatenated, and it looks ...
2
votes
1answer
99 views

Using AES-CTR as a PRNG

AES-CTR is not considered as a CSPRNG, why ? Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system ...
3
votes
1answer
67 views

Is precomputing AES-CTR key stream secure?

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ...
0
votes
1answer
57 views

AES-256 CTR with ESSIV, is this correct?

I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is: ...
0
votes
1answer
143 views

EAX vs CTR vs XTS + cascade ciphers in disk encryption hell

Often when I stumble across something interesting, I lose myself in the most overkill ways of implementing it. Today it was full disk encryption: I'm about to move to QubesOS, and I want to secure my ...
-2
votes
1answer
166 views

Which is more secure, AES CTR or OTP with generate key?

My idea of the OTP is to generate from 50 letters (5 words, each 10 letters) a new pad of 2000 random letters, then attach user email to the pad end (to make it unique). The keywords and the pad will ...
1
vote
2answers
244 views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
0
votes
1answer
93 views

Behavior of AES-CTR with 128-bit nonce and possible overflow

If I feed 128 bits of randomness into AES-CTR as its IV / nonce / initial counter, what will happen if I feed in a random 128-bit integer that overflows and wraps around? I've written a test for this ...
3
votes
1answer
815 views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
2
votes
1answer
70 views

How to encrypt huge amount of data using AES-CTR

As far as I know, AES-CTR depends on nonce. If I will use same key and nonce for encrypting 1 block of data and another - it will be unsecure. So, how can I encrypt a huge block of data (about 1GB) ...
1
vote
1answer
649 views

Is CTR really equally secure than CBC?

Here is a typical cryptographic situation: A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for ...
0
votes
1answer
98 views

Do I need to encrypt the IV?

For example, I'm using AES-CTR. I use fixed (random generated) key and random IV. I know that I have to encrypt key but I don't know about IV. If I will encrypt 1 block of data with fixed key and ...
2
votes
1answer
344 views

What is the maximum number of messages that can be encrypted using the same key for CTR mode?

In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key? The maximum ...
1
vote
0answers
66 views

Alternative AES key expansion for CTR based random number generator

Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT ...
1
vote
1answer
59 views

Performance of Counter mode (CTR) with Ciphertext Errors

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that: "As a result, its performance is identical to OFB's ...
0
votes
0answers
240 views

8 bit block cipher in CTR mode for practice - counter is 32 bits

I'm given a very simple 8 bit block cipher in which to encrypt plaintext x with k k one performs $ x \oplus k $. I am given IV = 0101 and a CTR of value CCCCCCCC (36bits). My understanding is that ...
1
vote
1answer
391 views

Block cipher linearity (in relation to hill ciphers)

So while I knew hill ciphers were a form of block cipher (I'm assuming all the ones I have solved to date were ECB or something similar), so that got me thinking. Is it possible to use hill ciphers in ...
1
vote
1answer
203 views

Is it safe to reuse the password when using AES-CTR with scrypt?

I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does: ...
0
votes
1answer
103 views

Can you defeat AES-CTR's birthday boundary with a 2nd AES?

This follows on from How do I produce a stream of secure random numbers from AES-Counter mode? Consider then the generator:- $$ \operatorname{AES_{k1}}(n) \oplus \operatorname{AES_{k2}}(n) $$ ...
1
vote
1answer
101 views

What encryption shoud I use for single char encryption?

I'm very new to encryption and I wanted to know if it is secure or just possible to use encryption on single chars. I did some research, but nothing to clear and i'm a bit confused. The modes I think ...
0
votes
1answer
95 views

Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
0
votes
0answers
227 views

How the counter of AES-CTR in SSH is used

I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the ...
0
votes
1answer
37 views

How many bytes of the last keystream block are used to XOR the final block of partial plaintext in CFB, OFB & CTR modes?

I apologize if this is a dumb question but I'm trying to understand how the final block of partial plaintext is XORed using only n number of bytes in the final keystream block. How do we determine ...
4
votes
1answer
896 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
2
votes
1answer
191 views

Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...

1
2 3 4 5