Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
1 vote
1 answer
80 views

Is it safe to "compress" an IV in AES256-CTR? [closed]

Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
user avatar
0 votes
0 answers
42 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
user avatar
1 vote
0 answers
93 views

Show that block cipher with CTR is a good PRNG

Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG. Counter mode works as follows: $Y_i = Enc_k(IV + f(i))$ $C_i = Y_i \bigoplus P_i = Y_i \...
user avatar
  • 123
0 votes
0 answers
37 views

Is Using HMAC-SHA256(key, counter) For Providing Pad Only Vulnerable To Bruteforce?

...
user avatar
0 votes
0 answers
33 views

Does random IVs in CTR block cipher mode combined with XOR allow to encrypt number of blocks up to the same numeric count of IV?

I read about CTR block cipher mode in Wikipedia: "If the IV/nonce is random, then they can be combined with the counter using any invertible operation (concatenation, addition, or XOR) to produce ...
user avatar
0 votes
0 answers
74 views

what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?

So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
user avatar
1 vote
1 answer
104 views

Performance of AES CTR + HMAC SHA1

I'm doing a performance test on AES with CTR mode and HMAC SHA1 for message authentication and found the openssl speed tool for that. I run multiple tests with <...
user avatar
  • 15
0 votes
1 answer
79 views

CTR HMAC SHA1 vs GCM Key management

The protocol SRTP uses by default AES in CTR mode with HMAC-SHA1. For my thesis I want to research if GCM would be a better option. Therefore I read following discussion. There the answer was that GCM ...
user avatar
  • 15
1 vote
1 answer
124 views

Is AES GCM without GMAC vulnerable against known plaintext attack?

Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
user avatar
  • 1,447
2 votes
2 answers
316 views

Does keeping IV secret increase security of CTR mode?

Let's suppose I encrypt something with CTR mode and keep the key and IV secret. Does keeping the IV secret together with the key increase strength of encryption?
user avatar
3 votes
2 answers
310 views

Proper use of AES CTR

I've read that AES CTR is only safe if used properly. Therefore, I want to be sure that I use it properly. The initial vector (IV) can only be used once, it doesn't have to be random. Is it secure to ...
user avatar
  • 33
0 votes
1 answer
66 views

CTR and OFB block cipher modes and their post-quantum security. Some questions [duplicate]

It's said that quantum computers can break block ciphers with 2^(n/2) queries (being n the key size). I read this paper: https://eprint.iacr.org/2016/197 It says that CTR and OFB modes are safe ...
user avatar
1 vote
0 answers
91 views

Size of the counter in CTR mode

If I understood it correctly, in CTR mode I encrypt the nonce or IV together with the counter as a block, which is then XORed with the plaintext. For the next block, I increment the counter. Is there ...
user avatar
  • 37
2 votes
3 answers
143 views

What does counter mean in Counter (CTR) Mode? Is it the same as nonce?

As asked above, what does "counter" mean exactly? Is it the same as nonce? Also, the book Network Security Essentials (6ed.) from William Stallings states, "Typically the counter is ...
user avatar
0 votes
1 answer
85 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
user avatar
  • 91
1 vote
1 answer
113 views

How is WinZip AES different from normal AES

I'm trying to write a function in dart that can can decrypt a file inside a zip that is encrypted using the WinZip AES-256 standard. Documentation I have found here: https://www.winzip.com/en/support/...
user avatar
  • 13
0 votes
0 answers
65 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
user avatar
2 votes
1 answer
254 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
user avatar
  • 1,322
1 vote
1 answer
455 views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
user avatar
2 votes
1 answer
199 views

Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?

Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext. The ...
user avatar
  • 711
1 vote
2 answers
78 views

Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]

Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size. ...
user avatar
  • 113
0 votes
0 answers
124 views

Simple XOR cipher with pseudo random plain text of arbitrary length

We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
user avatar
1 vote
0 answers
77 views

Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs. Will I get 512 bits of encryption strength?
user avatar
0 votes
1 answer
251 views

Comparing the security when using fixed IV for CBC and CTR

Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
user avatar
1 vote
1 answer
174 views

CTR block generation

From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my ...
user avatar
  • 421
0 votes
1 answer
94 views

Brute force strategy

I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption. Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
user avatar
  • 1
2 votes
1 answer
170 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
user avatar
  • 123
2 votes
1 answer
117 views

Cryptography Engineering - Design Principles and Practical Applications - Chapter 9 Generating Randomness - Section 9.4 The Generator

I'm currently reading "Cryptography Engineering - Design Principles and Practical Applications" written by "Niels Ferguson, Bruce Schneier, Tadayoshi Kohno" published by Wiley in ...
user avatar
3 votes
1 answer
576 views

AES CTR: Random IV

I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
user avatar
  • 155
2 votes
1 answer
336 views

AES256 CTR nonce generation

I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can ...
user avatar
3 votes
2 answers
239 views

How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?

I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
user avatar
  • 107
2 votes
2 answers
218 views

With AES-CTR does the block input need to be implemented as nonce || counter?

I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
user avatar
  • 179
2 votes
1 answer
330 views

AES CTR - Counter Management

Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each). How is the current used IV (nonce+ctr) synchronized among both communicating entities? I suppose that the ...
user avatar
  • 276
1 vote
1 answer
50 views

Malleability for varying length message

Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $...
user avatar
  • 321
3 votes
1 answer
140 views

Combining CTR and ECB modes to prevent attacks

In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
user avatar
  • 229
0 votes
0 answers
45 views

Re-encrypt modified file section with AES-CTR

I am trying to encrypt a file using AES/CTR/NoPadding. The goal is to re-encrypt the new/changed blocks and leave the old ones unchanged then generate a new MAC. My thinking is that when the file ...
user avatar
  • 101
3 votes
3 answers
626 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
user avatar
3 votes
0 answers
159 views

Is there any real attack deployed on the CTR mode over history?

The CTR mode, with its CPA security, is one of the malleable block cipher mode of operations. An attacker can simply modify the bits of the ciphertext stream in their advance. This is due to the lack ...
user avatar
  • 43.4k
12 votes
4 answers
5k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
user avatar
3 votes
1 answer
410 views

AES-CTR security if S-boxes substituion is omitted?

I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
user avatar
  • 373
1 vote
1 answer
172 views

Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?

I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
user avatar
1 vote
1 answer
97 views

What is encrypted with the key to give the keystream in CTR mode exactly?

I'm learning how CTR mode and there is something I have trouble understanding. If I understood correctly, two components are encrypted with the key, a nonce and a counter concatenated, and it looks ...
user avatar
2 votes
1 answer
291 views

Using AES-CTR as a PRNG

AES-CTR is not considered as a CSPRNG, why ? Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system ...
user avatar
2 votes
1 answer
100 views

Is precomputing AES-CTR key stream secure?

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ...
user avatar
0 votes
1 answer
100 views

AES-256 CTR with ESSIV, is this correct?

I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is: ...
user avatar
  • 1
0 votes
1 answer
238 views

EAX vs CTR vs XTS + cascade ciphers in disk encryption hell

Often when I stumble across something interesting, I lose myself in the most overkill ways of implementing it. Today it was full disk encryption: I'm about to move to QubesOS, and I want to secure my ...
user avatar
-1 votes
1 answer
280 views

Which is more secure, AES CTR or OTP with generate key?

My idea of the OTP is to generate from 50 letters (5 words, each 10 letters) a new pad of 2000 random letters, then attach user email to the pad end (to make it unique). The keywords and the pad will ...
user avatar
  • 13
1 vote
2 answers
933 views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
user avatar
  • 75
0 votes
1 answer
127 views

Behavior of AES-CTR with 128-bit nonce and possible overflow

If I feed 128 bits of randomness into AES-CTR as its IV / nonce / initial counter, what will happen if I feed in a random 128-bit integer that overflows and wraps around? I've written a test for this ...
user avatar
3 votes
1 answer
1k views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
user avatar

1
2 3 4 5