Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
18
votes
4answers
4k views

Is SHA-256 secure as a CTR block cipher?

Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x. We represent numbers in simple binary instead of a counting function. <...
18
votes
1answer
19k views

Why must IV/key-pairs not be reused in CTR mode?

Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ...
10
votes
4answers
3k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
42
votes
2answers
60k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
7
votes
1answer
920 views

Can we use a sort of “hash” function in CTR mode instead of a block cipher? [duplicate]

CTR mode does not use the decryption function at all, only the encryption function. This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
22
votes
1answer
5k views

(Why) should I avoid using a randomized IV for CTR mode?

I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
12
votes
1answer
7k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
3
votes
2answers
2k views

Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
12
votes
1answer
4k views

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
7
votes
1answer
3k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
7
votes
1answer
925 views

Multi-target attacks on AES-CTR with a random nonce

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ...,k_{2^{40}}...
9
votes
2answers
3k views

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
2
votes
1answer
2k views

Repeated NONCE in CTR mode

My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
8
votes
2answers
2k views

Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?

As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so: ...
6
votes
3answers
2k views

How do I produce a stream of secure random numbers from AES-Counter mode?

I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly. I have read that AES-CTR can produce a stream of ...
3
votes
1answer
241 views

AES CTR: Random IV

I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
1answer
375 views

What is the maximum number of messages that can be encrypted using the same key for CTR mode?

In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key? The maximum ...
5
votes
1answer
526 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ is a nonce $m$...
5
votes
1answer
643 views

Implementing 5 modes of operation with a hash function

Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
3
votes
1answer
320 views

AES-CTR security if S-boxes substituion is omitted?

I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
0
votes
1answer
604 views

Explain same encryption time for two files of different sizes

I am encrypting files in a two layered fashion as follows: Inner layer is 128 bit AES-CTR encryption Outer/Second layer is a simple one time padding with a particular key. While testing the running ...
20
votes
2answers
8k views

Why do we use XTS over CTR for disk encryption?

I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption. It seems that CTR mode would do exactly what XTS can do, but is simpler to ...
6
votes
3answers
1k views

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

The embedded device is a low-power 8-bit microcontroller (memory usage is constrained to about 10kb code, 1kb ram). As the device is battery-powered and manual service should be minimal, more powerful ...
6
votes
1answer
564 views

Strategy for random CTR initial counter values

Alice has a secret key which she uses to encrypt messages in CTR mode. CTR mode is critically vulnerable to counter reuse, and Alice has a problem: she has terrible memory and no pen to write anything ...
5
votes
2answers
7k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...
4
votes
1answer
905 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
16
votes
1answer
3k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
9
votes
1answer
3k views

Why doesn't CTR mode require blocking?

I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of ...
7
votes
2answers
2k views

How do we compute IV+1 in CTR mode?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
7
votes
2answers
2k views

Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says: A nonce N of 15-L octets. Within the ...
6
votes
5answers
6k views

AES decryption vs encryption speed

Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?
6
votes
3answers
1k views

Reusing AES-CTR Keys and IVs for File Encryption

I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go. I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
4
votes
1answer
6k views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
4
votes
2answers
8k views

AES-CTR vulnerability to cryptographic oracle

I am new to cryptographic issues and from what I googled so far I could not retrieve the information I need. Consider the use of AES-128 in CTR mode. Let M be the set of possible plaintexts, for ...
4
votes
2answers
714 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
3
votes
1answer
870 views

Using 0 nonce for AES-256 in CTR mode

My question is: I'm using AES with 256 bits key in CTR mode. Will it be less secure if I use a random key and static zero nonce? key = random; nonce = 0;
2
votes
1answer
607 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
1
vote
2answers
826 views

(Re-)Using deterministic IV in CTR mode / How to: deterministic AES

I am aware of the requirement of an IV to be unique in CTR mode (Why must IV/key-pairs not be reused in CTR mode?). However I wonder if I can use an IV depending on the plaintext deterministically. ...
0
votes
2answers
1k views

Encrypting small packets with low data rate

I'm trying to build my own layer of encryption on top of our bluetooth communication. We can't use bonding because of some specific features we need to support. I'm a beginner when it comes to ...
7
votes
2answers
450 views

Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
7
votes
1answer
2k views

CPA-security of CTR mode

I'm self-studying Katz' book (2nd ed), and I have a small question about Theorem 3.32, which says: If $F$ is a pseudorandom permutation, then $CTR$ mode is $CPA-$secure. They present a proof there,...
5
votes
1answer
1k views

IND-CPA security of CTR mode

Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
4
votes
1answer
517 views

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 ...
4
votes
2answers
1k views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
3
votes
1answer
1k views

Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
3
votes
1answer
804 views

File encryption with AES CTR mode

I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. ...
2
votes
1answer
110 views

AES-128/CTR/NoPadding HMAC vs Signature

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (<...
2
votes
0answers
412 views

Seekable cipher, is AES CTR a good solution?

I'd like to create a simple file-cipher, which provides seekable encryption (so I can decrypt any part of the encrypted message, without the need of decrypt from the start). Here's my current idea: I ...
1
vote
1answer
383 views

CTR vs CBC cycles per byte with OpenSSL EVP

I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption. (1) : I got 3.2 Cycles/Byte for CBC encryption. (2) : I got 0.7 Cycles/Byte for CBC decryption, CTR ...
1
vote
1answer
658 views

How is a PRP different from PRF? Both can be inverted to get the same input

PRP is said to be a bijective function which means that there is a one-to-one mapping with the output. And hence the output can be inverted using the decryption algorithm to get the same input. ...