Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
0
votes
0answers
2 views

Is precomputing AES-CTR key stream secure?

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? Q1 : If the precomputed key stream is very large like a few MB, it may be paged out to the disk, ...
0
votes
1answer
40 views

AES-256 CTR with ESSIV, is this correct?

I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is: ...
0
votes
0answers
19 views

tiny_aes ctr mode noob question [migrated]

I apologize for the newbie question. Could someone please elaborate how the ctr_xcrypt function below from the tiny_aes work. I read that CTR mode generates a key stream by encrypting a counter, and ...
0
votes
0answers
13 views

What are the roles of the “PACKAGER” in a digtial rights management system? [migrated]

I am studying about the basics of DRM systems. I came to know that the term packager is the application that encrypts the original content from the creator? Is there any other work this packager does?
0
votes
1answer
46 views

EAX vs CTR vs XTS + cascade ciphers in disk encryption hell

Often when I stumble across something interesting, I lose myself in the most overkill ways of implementing it. Today it was full disk encryption: I'm about to move to QubesOS, and I want to secure my ...
1
vote
2answers
86 views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
-1
votes
1answer
66 views

Which is more secure, AES CTR or OTP with generate key?

My idea of the OTP is to generate from 50 letters (5 words, each 10 letters) a new pad of 2000 random letters, then attach user email to the pad end (to make it unique). The keywords and the pad will ...
0
votes
1answer
47 views

Behavior of AES-CTR with 128-bit nonce and possible overflow

If I feed 128 bits of randomness into AES-CTR as its IV / nonce / initial counter, what will happen if I feed in a random 128-bit integer that overflows and wraps around? I've written a test for this ...
1
vote
1answer
104 views

Block cipher linearity (in relation to hill ciphers)

So while I knew hill ciphers were a form of block cipher (I'm assuming all the ones I have solved to date were ECB or something similar), so that got me thinking. Is it possible to use hill ciphers in ...
1
vote
1answer
57 views

How to encrypt huge amount of data using AES-CTR

As far as I know, AES-CTR depends on nonce. If I will use same key and nonce for encrypting 1 block of data and another - it will be unsecure. So, how can I encrypt a huge block of data (about 1GB) ...
3
votes
1answer
318 views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
1
vote
1answer
162 views

Is CTR really equally secure than CBC?

Here is a typical cryptographic situation: A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for ...
0
votes
1answer
62 views

Do I need to encrypt the IV?

For example, I'm using AES-CTR. I use fixed (random generated) key and random IV. I know that I have to encrypt key but I don't know about IV. If I will encrypt 1 block of data with fixed key and ...
4
votes
1answer
1k views

How to make cookies tamper-proof and secure by using encryption and hash / MAC

Our company has decided to ditch server side sessions in favor of storing authenticated information such as user id and access privilege information in a cookie. Before everyone jumps up and down ...
0
votes
1answer
115 views

What is the maximum number of messages that can be encrypted using the same key for CTR mode?

In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key? The maximum ...
1
vote
0answers
49 views

Alternative AES key expansion for CTR based random number generator

Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT ...
1
vote
1answer
48 views

Performance of Counter mode (CTR) with Ciphertext Errors

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that: "As a result, its performance is identical to OFB's ...
4
votes
1answer
435 views

What is the LENGTH parameter in EEA2?

In the EEA2 option for encryption in LTE the AES-128 algorithm is mechanized. There, the nonce used in the CTR Mode is a 128-bit value. The first 64-bits are covered by a COUNTER, a BEARER, a ...
1
vote
1answer
142 views

Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref) Under Known-Issues I found this paragraph: The RLPx ...
0
votes
0answers
112 views

8 bit block cipher in CTR mode for practice - counter is 32 bits

I'm given a very simple 8 bit block cipher in which to encrypt plaintext x with k k one performs $ x \oplus k $. I am given IV = 0101 and a CTR of value CCCCCCCC (36bits). My understanding is that ...
5
votes
1answer
502 views

AES-XTS vs AES-CTR for Write Once Storage

I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be ...
1
vote
1answer
151 views

Is it safe to reuse the password when using AES-CTR with scrypt?

I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does: ...
4
votes
2answers
2k views

How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and "...
3
votes
1answer
971 views

Using checksum instead of hash for authenticating ciphers

Lets assume for a specific situation we cannot use authenticated encryption like GCM ... If we were to use CTR, what would you think of using a checksum on the plaintext then encrypt the whole. The ...
0
votes
1answer
93 views

Can you defeat AES-CTR's birthday boundary with a 2nd AES?

This follows on from How do I produce a stream of secure random numbers from AES-Counter mode? Consider then the generator:- $$ \operatorname{AES_{k1}}(n) \oplus \operatorname{AES_{k2}}(n) $$ ...
6
votes
3answers
2k views

How do I produce a stream of secure random numbers from AES-Counter mode?

I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly. I have read that AES-CTR can produce a stream of ...
1
vote
1answer
98 views

What encryption shoud I use for single char encryption?

I'm very new to encryption and I wanted to know if it is secure or just possible to use encryption on single chars. I did some research, but nothing to clear and i'm a bit confused. The modes I think ...
3
votes
1answer
1k views

Does an IV need to be used in AES CTR mode?

If I encrypt a message once using AES CTR, will I need an IV? Additionally, if I do use an IV, will I need to send it with the cipher text?
0
votes
1answer
71 views

Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
0
votes
0answers
161 views

How the counter of AES-CTR in SSH is used

I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the ...
2
votes
1answer
137 views

Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
3
votes
1answer
410 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
0
votes
1answer
35 views

How many bytes of the last keystream block are used to XOR the final block of partial plaintext in CFB, OFB & CTR modes?

I apologize if this is a dumb question but I'm trying to understand how the final block of partial plaintext is XORed using only n number of bytes in the final keystream block. How do we determine ...
4
votes
1answer
237 views

How does CTR-ESSIV work?

I'm using Wikipedia and Handbook of Applied Cryptography as references. I know that ESSIV generates an initialization vector (IV) by combining a hashed key with the sector number. However, I only see ...
4
votes
1answer
832 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
2
votes
1answer
181 views

Why is a one-time MAC secure for MAC-then-encrypt with randomized-CTR but not randomized-CBC?

The Coursera cryptography 1 course says: If you want to use MAC-then-encrypt mode then you should either use randomized-CTR or randomized-CBC. And if you use randomized-CTR then one-time-MAC ...
2
votes
1answer
163 views

Why does the authenticated cipher CCM encrypt the MAC too?

Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC? In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks". But I can not ...
1
vote
1answer
87 views

On the probability of a collision in RFO-rCTR

My slides show that assuming a polynomial number $q(n)$ of blocks have been encrypted by a random function oracle in the context of a CPA-game, the probability of having a collision in the input to ...
0
votes
1answer
268 views

how to compute IV with AES CTR if key, plaintext and ciphertext are known?

Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
4
votes
1answer
368 views

Hashing a counter to prevent distinguishers in CTR mode

Because a block cipher is a PRP and thus bijective, the fact that the input in CTR mode never repeats means that each block of keystream will be unique. This creates a distinguisher from random data ...
0
votes
2answers
301 views

Aes Ctr non-secure PRNG

I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (...
1
vote
1answer
82 views

Strength of Sha512Ctr PRNG

What is the cryptographic strength of sha512ctr when I simply concatenate a counter and 64 bytes from a cryptographic random number generator (in this case RNGCryptoServiceProvider from .net), and ...
2
votes
1answer
79 views

emulating AES GCM with AES CTR

Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it. My question is... what happens ...
0
votes
0answers
132 views

Building a CPA-secure sCTR from a PRF

Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$. For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG ...
1
vote
1answer
671 views

Is it possible to do a known-plaintext attack with this set up of AES CTR mode?

Is it possible to perform a known-plaintext attack to extract the key from AES byte encryption? The encryption is setup with the following two lines: ...
2
votes
3answers
286 views

AES-CTR-MAC alternative

I have to send small (~10 bytes) authenticated messages over an insecure channel. I was thinking of an alternative to the "conventional" AES128-CTR-MAC, which will take 16 bytes for the CT and ...
1
vote
1answer
431 views

How is a PRP different from PRF? Both can be inverted to get the same input

PRP is said to be a bijective function which means that there is a one-to-one mapping with the output. And hence the output can be inverted using the decryption algorithm to get the same input. ...
0
votes
1answer
321 views

Why is stateful CTR slightly better than stateless CTR? Does the adversary know the value of counter in CTR mode of operation?

This might be a stupid question but is really fundamental in my understanding of CTR (I'm a newbie to cryptography theory). For CPA security, the adversary only knows the IV, and may query the oracle ...
21
votes
1answer
5k views

(Why) should I avoid using a randomized IV for CTR mode?

I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
0
votes
1answer
79 views

IV transmission from Transmitter to Receiver side in CTR mode for every call

I am using block cipher mode (CTR Mode) for the transmission of voice data. Need to know, how can I transfer the same IV at the decryption side (for every call) as the IV for the same packets on ...