Questions tagged [ctr]
Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.
53
questions
19
votes
4
answers
5k
views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. <...
- 575
13
votes
4
answers
8k
views
Disadvantages of AES-CTR?
On paper, it sounds *very* good to me:
secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
- 487
20
votes
1
answer
24k
views
Why must IV/key-pairs not be reused in CTR mode?
Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ...
- 637
47
votes
2
answers
75k
views
AES CBC mode or AES CTR mode recommended?
What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
- 1,031
24
votes
1
answer
6k
views
(Why) should I avoid using a randomized IV for CTR mode?
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
- 1
14
votes
1
answer
9k
views
Reusing keys with AES-CBC
I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC.
Is reusing the same key several ...
- 523
3
votes
2
answers
2k
views
Making counter (CTR) mode robust against application state loss
Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
- 33
24
votes
2
answers
9k
views
Why do we use XTS over CTR for disk encryption?
I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption.
It seems that CTR mode would do exactly what XTS can do, but is simpler to ...
- 343
12
votes
1
answer
4k
views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
- 24.8k
8
votes
1
answer
5k
views
Relationship between AES GCM and AES CTR
I have read that AES GCM uses AES CTR for encryption and GMAC for authentication.
If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR?
TO put the ...
- 83
7
votes
1
answer
1k
views
Can we use a sort of "hash" function in CTR mode instead of a block cipher? [duplicate]
CTR mode does not use the decryption function at all, only the encryption function.
This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
- 3,922
7
votes
1
answer
1k
views
Multi-target attacks on AES-CTR with a random nonce
128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example:
Generate keys $k_1, k_2, ...,k_{2^{40}}...
- 2,814
3
votes
1
answer
1k
views
What is the maximum number of messages that can be encrypted using the same key for CTR mode?
In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key?
The maximum ...
- 43
9
votes
2
answers
3k
views
What does a stream cipher provide that cannot be obtained with AES CTR mode operation?
I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
- 861
9
votes
2
answers
2k
views
Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so:
...
- 193
6
votes
3
answers
2k
views
How do I produce a stream of secure random numbers from AES-Counter mode?
I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly.
I have read that AES-CTR can produce a stream of ...
- 433
5
votes
1
answer
832
views
Implementing 5 modes of operation with a hash function
Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
- 53
5
votes
1
answer
682
views
Using HMAC as a nonce with AES-CTR encrypt-and-MAC
Suppose I use the following encrypt-and-MAC construction:
$E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where:
$k_1$ and $k_2$ are 256-bit keys
$n$ is a nonce
$m$...
- 2,814
3
votes
1
answer
1k
views
AES CTR: Random IV
I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
- 165
3
votes
1
answer
516
views
AES-CTR security if S-boxes substituion is omitted?
I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
- 403
2
votes
1
answer
2k
views
Repeated NONCE in CTR mode
My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
- 23
0
votes
1
answer
660
views
Explain same encryption time for two files of different sizes
I am encrypting files in a two layered fashion as follows:
Inner layer is 128 bit AES-CTR encryption
Outer/Second layer is a simple one time padding with a particular key.
While testing the running ...
- 101
17
votes
1
answer
4k
views
What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
It seems the only specified CTR mode ciphers in TLS are all GCM based.
GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
- 447
10
votes
1
answer
4k
views
Why doesn't CTR mode require blocking?
I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of ...
- 211
8
votes
2
answers
2k
views
Picking a nonce in the context of CCM (CTR with CBC-MAC) mode
After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says:
A nonce N of 15-L octets. Within the scope ...
- 281
8
votes
2
answers
3k
views
How do we compute IV+1 in CTR mode?
This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation?
For example, if I have the IV ...
- 3,922
8
votes
5
answers
7k
views
AES decryption vs encryption speed
Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?
- 2,837
7
votes
1
answer
2k
views
CPA-security of CTR mode
I'm self-studying Katz' book (2nd ed), and I have a small question about Theorem 3.32, which says:
If $F$ is a pseudorandom permutation, then $CTR$ mode is $CPA-$secure.
They present a proof there,...
- 3,922
7
votes
2
answers
572
views
Turning a 64 bit block cipher into a 128 bit block cipher
There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical.
...
- 91.8k
6
votes
3
answers
1k
views
Reusing AES-CTR Keys and IVs for File Encryption
I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go.
I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
- 63
6
votes
1
answer
675
views
Strategy for random CTR initial counter values
Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything ...
6
votes
3
answers
1k
views
secure embedded/microcontroller crypto using AES-ctr with hmac-sha2
The embedded device is a low-power 8-bit microcontroller (memory usage is constrained to about 10kb code, 1kb ram). As the device is battery-powered and manual service should be minimal, more powerful ...
- 61
5
votes
1
answer
1k
views
How to Implement Deterministic Encryption Safely in .NET
I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
- 51
5
votes
2
answers
8k
views
AES+CTR+HMAC Encryption and Authentication on an Arduino
In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel.
We have chosen AES in CTR ...
- 53
5
votes
1
answer
562
views
Can I use MAC as CTR mode nonce, if my messages are non-repeating?
I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 ...
5
votes
1
answer
2k
views
IND-CPA security of CTR mode
Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
- 53
4
votes
1
answer
9k
views
Message lengths with AES CTR mode?
Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states:
In the case of CTR, we are merely XORing the output ...
4
votes
2
answers
9k
views
AES-CTR vulnerability to cryptographic oracle
I am new to cryptographic issues and from what I googled so far I could not retrieve the information I need.
Consider the use of AES-128 in CTR mode.
Let M be the set of possible plaintexts, for ...
- 227
4
votes
2
answers
2k
views
Are all stream-ciphers IND-CPA?
A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
- 45.7k
4
votes
2
answers
776
views
CTR mode nonce with aggressive key rotation policy
I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce.
Normally ...
- 4,626
3
votes
1
answer
2k
views
Counter Mode: static IV but different keys [duplicate]
Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue?
I know that in CTR mode, same key-iv ...
- 31
3
votes
1
answer
2k
views
Using 0 nonce for AES-256 in CTR mode
My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce?
key = random;
nonce = 0;
- 63
3
votes
1
answer
1k
views
File encryption with AES CTR mode
I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. ...
- 31
2
votes
1
answer
289
views
AES-128/CTR/NoPadding HMAC vs Signature
Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
- 123
2
votes
0
answers
512
views
Seekable cipher, is AES CTR a good solution?
I'd like to create a simple file-cipher, which provides seekable encryption (so I can decrypt any part of the encrypted message, without the need of decrypt from the start).
Here's my current idea: I ...
- 333
2
votes
1
answer
666
views
AES-CTR-256 Sub Keys With Encrypted Sub Key Index
I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files.
You start with a key file generated from random data. For example you could ...
- 153
1
vote
0
answers
74
views
one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]
Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
- 197
1
vote
2
answers
920
views
(Re-)Using deterministic IV in CTR mode / How to: deterministic AES
I am aware of the requirement of an IV to be unique in CTR mode (Why must IV/key-pairs not be reused in CTR mode?). However I wonder if I can use an IV depending on the plaintext deterministically. ...
- 125
1
vote
1
answer
457
views
CTR vs CBC cycles per byte with OpenSSL EVP
I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption.
(1) : I got 3.2 Cycles/Byte for CBC encryption.
(2) : I got 0.7 Cycles/Byte for CBC decryption, CTR ...
- 317
1
vote
1
answer
1k
views
How is a PRP different from PRF? Both can be inverted to get the same input
PRP is said to be a bijective function which means that there is a one-to-one mapping with the output. And hence the output can be inverted using the decryption algorithm to get the same input.
...
- 508