# Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

185 questions
Filter by
Sorted by
Tagged with
69 views

### What is the maximum number of messages that can be encrypted using the same key for CTR mode?

In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key? The maximum ...
30 views

### Alternative AES key expansion for CTR based random number generator

Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT ...
40 views

### Performance of Counter mode (CTR) with Ciphertext Errors

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that: "As a result, its performance is identical to OFB's ...
74 views

### 8 bit block cipher in CTR mode for practice - counter is 32 bits

I'm given a very simple 8 bit block cipher in which to encrypt plaintext x with k k one performs $x \oplus k$. I am given IV = 0101 and a CTR of value CCCCCCCC (36bits). My understanding is that ...
57 views

### Block cipher linearity (in relation to hill ciphers)

So while I knew hill ciphers were a form of block cipher (I'm assuming all the ones I have solved to date were ECB or something similar), so that got me thinking. Is it possible to use hill ciphers in ...
120 views

### Is it safe to reuse the password when using AES-CTR with scrypt?

I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does: ...
82 views

### Can you defeat AES-CTR's birthday boundary with a 2nd AES?

This follows on from How do I produce a stream of secure random numbers from AES-Counter mode? Consider then the generator:- $$\operatorname{AES_{k1}}(n) \oplus \operatorname{AES_{k2}}(n)$$ ...
83 views

### What encryption shoud I use for single char encryption?

I'm very new to encryption and I wanted to know if it is secure or just possible to use encryption on single chars. I did some research, but nothing to clear and i'm a bit confused. The modes I think ...
64 views

### Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
111 views

### How the counter of AES-CTR in SSH is used

I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the ...
31 views

### How many bytes of the last keystream block are used to XOR the final block of partial plaintext in CFB, OFB & CTR modes?

I apologize if this is a dumb question but I'm trying to understand how the final block of partial plaintext is XORed using only n number of bytes in the final keystream block. How do we determine ...
774 views

### How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
121 views

### Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
152 views

### how to compute IV with AES CTR if key, plaintext and ciphertext are known?

Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
353 views

### Hashing a counter to prevent distinguishers in CTR mode

Because a block cipher is a PRP and thus bijective, the fact that the input in CTR mode never repeats means that each block of keystream will be unique. This creates a distinguisher from random data ...
225 views

### Aes Ctr non-secure PRNG

I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (...
77 views

### Strength of Sha512Ctr PRNG

What is the cryptographic strength of sha512ctr when I simply concatenate a counter and 64 bytes from a cryptographic random number generator (in this case RNGCryptoServiceProvider from .net), and ...
328 views

### AES-XTS vs AES-CTR for Write Once Storage

I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be ...
65 views

### emulating AES GCM with AES CTR

Building off of Relationship between AES GCM and AES CTR... if your GCM nonce is "aaaa aaaa aaaa" (no spaces) then the CTR IV is that with (0,0,0,2) appending to it. My question is... what happens ...
85 views

### On the probability of a collision in RFO-rCTR

My slides show that assuming a polynomial number $q(n)$ of blocks have been encrypted by a random function oracle in the context of a CPA-game, the probability of having a collision in the input to ...
108 views

### Building a CPA-secure sCTR from a PRF

Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$. For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG ...
512 views

### Is it possible to do a known-plaintext attack with this set up of AES CTR mode?

Is it possible to perform a known-plaintext attack to extract the key from AES byte encryption? The encryption is setup with the following two lines: ...
175 views

### AES-CTR-MAC alternative

I have to send small (~10 bytes) authenticated messages over an insecure channel. I was thinking of an alternative to the "conventional" AES128-CTR-MAC, which will take 16 bytes for the CT and ...
303 views

### How is a PRP different from PRF? Both can be inverted to get the same input

PRP is said to be a bijective function which means that there is a one-to-one mapping with the output. And hence the output can be inverted using the decryption algorithm to get the same input. ...
116 views

### Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref) Under Known-Issues I found this paragraph: The RLPx ...
256 views

### Why is stateful CTR slightly better than stateless CTR? Does the adversary know the value of counter in CTR mode of operation?

This might be a stupid question but is really fundamental in my understanding of CTR (I'm a newbie to cryptography theory). For CPA security, the adversary only knows the IV, and may query the oracle ...
807 views

### Does an IV need to be used in AES CTR mode?

If I encrypt a message once using AES CTR, will I need an IV? Additionally, if I do use an IV, will I need to send it with the cipher text?
64 views

### IV transmission from Transmitter to Receiver side in CTR mode for every call

I am using block cipher mode (CTR Mode) for the transmission of voice data. Need to know, how can I transfer the same IV at the decryption side (for every call) as the IV for the same packets on ...
93 views

### Can we replace IV increasing from addition to XOR in CTR mode?

In CTR mode (not nonce-based), if we have ${IV}\stackrel{\$}{\leftarrow}\{0,1\}^{128}$and want to encrypt message blocks$M_1, M_2, ..., M_\ell \in\{0,1\}^{128}$: The ciphertext is$IV\parallel C_1\...
208 views

### AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
52 views

### Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write?

I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file ...
586 views

### What are the risks of using CTR mode with 64 bit blocks?

On DJB's blog he writes: I was one of about 40 people sitting in a meeting where the speaker, NSA's Louis Wingers (one of the Simon and Speck authors), falsely claimed that counter mode is safe for ...
71 views

### Why do we only encrypt nounce + counter in Counter Mode?

I do not understand, what the advantage is in only encrypting the nonce + Ctr and XORing this to our plaintext, instead of encrypting everything. (If our block cipher can be easily decrypted) What ...
54 views

### Why can't we use the IDEA's decryption rule for decrypting a block on CTR mode?

Suppose that a block is ciphered with IDEA using CTR mode operation. To get the original message, why can't we use the cyphered rule?
292 views

### AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
40 views

### Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
132 views

### Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key ...
268 views

### Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
577 views

### ciphertext stealing and CTR

Why Does CTR mode encryption not use ciphertext stealing?
365 views

### Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
88 views

### Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
370 views

### AES in CTR mode, with a single key, and an IV derived from the plaintext

We need a system to compare cipher-texts for equality, without (the checking system) having access to the plaintext. We found a library that uses AES in CTR mode, with a single key, and an IV based ...
5k views

### How insecure is AES-128-CTR to encrypt any kind of data using the Ethereum keystore file format?

I am using the Ethereum keystore file format to encrypt any other data such a plain text or JSON. Here is an example of pseudocode of the implementation: ...
340 views

### Is my AES-128-CTR implementation secure enough to encrypt private keys and mnemonic seed? [closed]

I am building a cryptocurrency wallet online where everything is stored in the browser (No servers). At this moment I am storing all private keys encrypted using AES-128-CTR I've chosen this method ...
115 views

### Practical implications of the switching lemma and the counter mode security bound

I have some trouble with determining how many times a key can be safely used when using counter mode encryption. For example: We split the IV into two parts, a message counter (nonce) and a block ...
424 views

### how to obtain the plaintext in counter mode using the AES block cipher

I want to obtain the plaintexts. Sentence1 ...
45 views

### Upper bound of this derivative of counter mode?

Suppose that: $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$. $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$. $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$. $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$. \$E(K, X): \...
280 views

### Near in place encryption with BouncyCastle CCM, How large must IV and MAC be?

I need to encrypt 20 bytes of data and the encrypted nonce + data + mac cannot exceed 30 bytes in size. I have an implementation but i'm not sure if i'm cutting too many corners and compromising ...