Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
0
votes
1answer
33 views

How to produce Auth Data and tag in GCM? Does MAC appended CTR mode encrypted text weaker than GCM?

In https://en.wikipedia.org/wiki/Galois/Counter_Mode, there's a diagram which tells us how GCM works in general. I have watched computerphile video on how ECB,CBC and CTR mode works and able to ...
2
votes
1answer
525 views

Block cipher linearity (in relation to hill ciphers)

So while I knew hill ciphers were a form of block cipher (I'm assuming all the ones I have solved to date were ECB or something similar), so that got me thinking. Is it possible to use hill ciphers in ...
1
vote
1answer
82 views

How is WinZip AES different from normal AES

I'm trying to write a function in dart that can can decrypt a file inside a zip that is encrypted using the WinZip AES-256 standard. Documentation I have found here: https://www.winzip.com/en/support/...
0
votes
1answer
311 views

8 bit block cipher in CTR mode for practice - counter is 32 bits

I'm given a very simple 8 bit block cipher in which to encrypt plaintext x with k k one performs $ x \oplus k $. I am given IV = 0101 and a CTR of value CCCCCCCC (36bits). My understanding is that ...
1
vote
1answer
191 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
0
votes
0answers
64 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
7
votes
1answer
947 views

Multi-target attacks on AES-CTR with a random nonce

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ...,k_{2^{40}}...
0
votes
1answer
128 views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
2
votes
1answer
127 views

Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?

Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext. The ...
1
vote
2answers
56 views

Why is xor'ing plaintext blocks and encrypting the resulting checksum not a secure MAC using CTR mode? [closed]

Consider message $P$ being split into $n$ blocks that match the block size of the underlying block cipher. The message has fixed length and the length is always a multiple of the block size. ...
0
votes
0answers
73 views

Mismatch between NIST SP800-90A test vectors and CTR_DRBG output

I am testing my Python implementation of NIST SP800-90A CTR_DRBG https://csrc.nist.gov/publications/detail/sp/800-90a/rev-1/final (AES-256, no df) with the CAVP test vectors (https://csrc.nist.gov/...
0
votes
0answers
40 views

Hashing function as a cipher in CTR mode [duplicate]

Can we use hashing function in CTR mode as a cipher? And our key could be a random initialization vector. Are there any practical problems with that idea, that we don't do this?
0
votes
0answers
80 views

Simple XOR cipher with pseudo random plain text of arbitrary length

We all know that simple repeated XOR cipher over plaintext is trivially vulnerable to known plaintext attack, even when just a part of plain text is known and even to ciphertext only attack if you ...
0
votes
1answer
102 views

Comparing the security when using fixed IV for CBC and CTR

Assuming that I'm using fixed IV's for CBC mode and CTR mode. I know that in CBC, the blocks depend on the previous ones and on CTR they are all independent. Yet with the same key and fixed IV, the ...
1
vote
0answers
64 views

Is multiple encryption with CTR mode vulnerable to meet-in-the-middle attacks?

Let's suppose I want to encrypt my disk partition with AES-256 in CTR mode 2 times using two different keys and IVs. Will I get 512 bits of encryption strength?
43
votes
2answers
62k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
1
vote
1answer
132 views

CTR block generation

From what I understand, CTR works by taking a counter, concatenating it with a nonce, and encrypting the result, which gets XORed to the ciphertext. For a 128-bit block cipher (ie. AES), my ...
2
votes
1answer
116 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
0
votes
1answer
69 views

Brute force strategy

I am a beginner in this field, and I was thinking about brute force strategies to break symmetric key encryption. Let's say we have a block cipher in CTR mode and the key is 56 bits in size. What ...
2
votes
1answer
109 views

Cryptography Engineering - Design Principles and Practical Applications - Chapter 9 Generating Randomness - Section 9.4 The Generator

I'm currently reading "Cryptography Engineering - Design Principles and Practical Applications" written by "Niels Ferguson, Bruce Schneier, Tadayoshi Kohno" published by Wiley in ...
3
votes
2answers
157 views

How to correctly implement an archetypal encrypt-then-MAC AES-CTR + HMAC mode cipher?

I've created an AES implementation in Python as a learning experience (mainly for encrypting/decrypting files), and wanted to make sure that I haven't made any huge mistakes in my logic (of course, ...
2
votes
1answer
233 views

Practical implications of the switching lemma and the counter mode security bound

I have some trouble with determining how many times a key can be safely used when using counter mode encryption. If we, for example, split the IV into two parts, a message counter (nonce) and a block ...
1
vote
3answers
2k views

Counter based cipher using HMAC-SHA-256

After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR mode with HMAC-SHA-256. From what I understand, I can use the IV as a counter, and the ...
2
votes
2answers
155 views

With AES-CTR does the block input need to be implemented as nonce || counter?

I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
3
votes
1answer
328 views

AES CTR: Random IV

I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
1answer
197 views

AES256 CTR nonce generation

I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can ...
1
vote
1answer
186 views

AES CTR - Counter Management

Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each). How is the current used IV (nonce+ctr) synchronized among both communicating entities? I suppose that the ...
2
votes
1answer
117 views

Combining CTR and ECB modes to prevent attacks

In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
1
vote
1answer
48 views

Malleability for varying length message

Given ciphertext for a message encrypted using $AES-CTR$ along with actual, desired message and IV, I need to perform malleability attack on the ciphertext to change the original message from $M$ to $...
6
votes
3answers
1k views

Reusing AES-CTR Keys and IVs for File Encryption

I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go. I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
3
votes
3answers
418 views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
0
votes
0answers
37 views

Re-encrypt modified file section with AES-CTR

I am trying to encrypt a file using AES/CTR/NoPadding. The goal is to re-encrypt the new/changed blocks and leave the old ones unchanged then generate a new MAC. My thinking is that when the file ...
3
votes
0answers
130 views

Is there any real attack deployed on the CTR mode over history?

The CTR mode, with its CPA security, is one of the malleable block cipher mode of operations. An attacker can simply modify the bits of the ciphertext stream in their advance. This is due to the lack ...
9
votes
4answers
3k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
3
votes
1answer
340 views

AES-CTR security if S-boxes substituion is omitted?

I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
1
vote
1answer
105 views

Can I use different IVs when encrypting identical plaintexts with identical keys with AES-CTR?

I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's ...
1
vote
1answer
72 views

What is encrypted with the key to give the keystream in CTR mode exactly?

I'm learning how CTR mode and there is something I have trouble understanding. If I understood correctly, two components are encrypted with the key, a nonce and a counter concatenated, and it looks ...
2
votes
1answer
142 views

Using AES-CTR as a PRNG

AES-CTR is not considered as a CSPRNG, why ? Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system ...
1
vote
1answer
915 views

Padding Oracle Attack with AES-128-CTR and MAC

Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm. Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-...
2
votes
1answer
80 views

Is precomputing AES-CTR key stream secure?

Q0 : Is the precomputed key stream vulnerable to side-channel attacks like a lookup table for exemple ? I don't think it is because a lookup table is accesed very often, that's what makes it non ...
0
votes
1answer
77 views

AES-256 CTR with ESSIV, is this correct?

I am having some problems encrypting disk using AES-256 in CTR mode, with ESSIV iv generation (I am aware of couple of flaws, although this mode is enough for now). What I have here is: ...
0
votes
1answer
183 views

EAX vs CTR vs XTS + cascade ciphers in disk encryption hell

Often when I stumble across something interesting, I lose myself in the most overkill ways of implementing it. Today it was full disk encryption: I'm about to move to QubesOS, and I want to secure my ...
1
vote
2answers
478 views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
-2
votes
1answer
193 views

Which is more secure, AES CTR or OTP with generate key?

My idea of the OTP is to generate from 50 letters (5 words, each 10 letters) a new pad of 2000 random letters, then attach user email to the pad end (to make it unique). The keywords and the pad will ...
0
votes
1answer
107 views

Behavior of AES-CTR with 128-bit nonce and possible overflow

If I feed 128 bits of randomness into AES-CTR as its IV / nonce / initial counter, what will happen if I feed in a random 128-bit integer that overflows and wraps around? I've written a test for this ...
2
votes
1answer
73 views

How to encrypt huge amount of data using AES-CTR

As far as I know, AES-CTR depends on nonce. If I will use same key and nonce for encrypting 1 block of data and another - it will be unsecure. So, how can I encrypt a huge block of data (about 1GB) ...
3
votes
1answer
949 views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
1
vote
1answer
808 views

Is CTR really equally secure than CBC?

Here is a typical cryptographic situation: A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for ...
0
votes
1answer
125 views

Do I need to encrypt the IV?

For example, I'm using AES-CTR. I use fixed (random generated) key and random IV. I know that I have to encrypt key but I don't know about IV. If I will encrypt 1 block of data with fixed key and ...
4
votes
1answer
1k views

How to make cookies tamper-proof and secure by using encryption and hash / MAC

Our company has decided to ditch server side sessions in favor of storing authenticated information such as user id and access privilege information in a cookie. Before everyone jumps up and down ...

1
2 3 4 5