Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
0
votes
1answer
114 views

Can we replace IV increasing from addition to XOR in CTR mode?

In CTR mode (not nonce-based), if we have ${IV}\stackrel{\$}{\leftarrow}\{0,1\}^{128}$ and want to encrypt message blocks $M_1, M_2, ..., M_\ell \in\{0,1\}^{128}$: The ciphertext is $IV\parallel C_1\...
3
votes
2answers
136 views

Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key ...
4
votes
4answers
302 views

Mitigating Side Channel Attack (SCA)

The SCA power attack described in 2016 article called "Power Side Channels in Security ICs: Hardware Countermeasures", depends on the measurement of power consumption fluctuations during AES-128 ...
4
votes
0answers
225 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
1
vote
0answers
52 views

Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write?

I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file ...
9
votes
2answers
2k views

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
14
votes
2answers
717 views

What are the risks of using CTR mode with 64 bit blocks?

On DJB's blog he writes: I was one of about 40 people sitting in a meeting where the speaker, NSA's Louis Wingers (one of the Simon and Speck authors), falsely claimed that counter mode is safe for ...
1
vote
1answer
77 views

Why do we only encrypt nounce + counter in Counter Mode?

I do not understand, what the advantage is in only encrypting the nonce + Ctr and XORing this to our plaintext, instead of encrypting everything. (If our block cipher can be easily decrypted) What ...
0
votes
1answer
54 views

Why can't we use the IDEA's decryption rule for decrypting a block on CTR mode?

Suppose that a block is ciphered with IDEA using CTR mode operation. To get the original message, why can't we use the cyphered rule?
2
votes
1answer
411 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
1
vote
1answer
43 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
7
votes
1answer
881 views

Security of a simple AEAD construction

Introduction I want securely communicate with a small 8-bit device which has a very limited program program memory (Arduino Uno - 32K). My goal is to minimize code size and RAM usage. There are ...
-2
votes
2answers
710 views

ciphertext stealing and CTR

Why Does CTR mode encryption not use ciphertext stealing?
2
votes
1answer
135 views

Practical implications of the switching lemma and the counter mode security bound

I have some trouble with determining how many times a key can be safely used when using counter mode encryption. For example: We split the IV into two parts, a message counter (nonce) and a block ...
0
votes
1answer
95 views

Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
0
votes
1answer
476 views

AES in CTR mode, with a single key, and an IV derived from the plaintext

We need a system to compare cipher-texts for equality, without (the checking system) having access to the plaintext. We found a library that uses AES in CTR mode, with a single key, and an IV based ...
3
votes
2answers
6k views

How insecure is AES-128-CTR to encrypt any kind of data using the Ethereum keystore file format?

I am using the Ethereum keystore file format to encrypt any other data such a plain text or JSON. Here is an example of pseudocode of the implementation: ...
0
votes
1answer
360 views

Is my AES-128-CTR implementation secure enough to encrypt private keys and mnemonic seed? [closed]

I am building a cryptocurrency wallet online where everything is stored in the browser (No servers). At this moment I am storing all private keys encrypted using AES-128-CTR I've chosen this method ...
1
vote
0answers
47 views

Upper bound of this derivative of counter mode?

Suppose that: $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$. $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$. $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$. $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$. $E(K, X): \...
0
votes
1answer
502 views

how to obtain the plaintext in counter mode using the AES block cipher

I want to obtain the plaintexts. Sentence1 ...
1
vote
1answer
232 views

How used nonce in CTR Mode of AES-EAX Encryption?

I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
1
vote
1answer
328 views

Near in place encryption with BouncyCastle CCM, How large must IV and MAC be?

I need to encrypt 20 bytes of data and the encrypted nonce + data + mac cannot exceed 30 bytes in size. I have an implementation but i'm not sure if i'm cutting too many corners and compromising ...
3
votes
1answer
5k views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
1
vote
0answers
77 views

Is there any cipher standard based on SHA-3, where it is not used as part of RFC2104?

I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this: IV|AES-CTR(PLAINTEXT_SIZE|PLAINTEXT|SHA-3(KEY|PLAINTEXT_SIZE|PLAINTEXT)) So, ...
4
votes
1answer
174 views

Why does CTR mode become insecure after $2^{0.5 \times n}$ blocks?

The question is exactly what it says on the tin. If $n$ is the block size in bits of a block cipher, then why does outputting $2^{0.5 \times n}$ block in counter mode become a problem when there is no ...
2
votes
0answers
364 views

Seekable cipher, is AES CTR a good solution?

I'd like to create a simple file-cipher, which provides seekable encryption (so I can decrypt any part of the encrypted message, without the need of decrypt from the start). Here's my current idea: I ...
1
vote
1answer
443 views

Is AES-CTR-NoPadding resistant to variable-length chosen-plaintext attack?

Consider the following scenario: an adversary $A$ with access to an encryption oracle $\mathcal{O}$ is able to choose $n \in \mathbb{N}$ and pick $p_1,\dots,p_n$ such that $\forall i \in \{1,\dots,n\}:...
5
votes
2answers
2k views

Why isn't CTR mode (counter mode) used more often?

For the CTR mode, the design is good for parallelization, yes, it seems the benchmark of the program downloaded from crypto++ proves that on an Intel I7 CPU. My question is that as most of CPU on ...
5
votes
2answers
917 views

Security of non-standard use for AES-256-CTR?

I have a string secret that I would like to encrypt for storage in a Yubikey's second slot. These slots can be configured to store up to 38 characters that are later "typed" by the USB device acting ...
2
votes
0answers
248 views

AES-CTR and AES-CMAC using the same temporary key

Is it a severe security issue using a short-lived dynamic key for both AES-CTR and AES-CMAC? CMAC is generated on the cleartext and 32 bit of it are attached to the message (MAC-and-Encrypt) The key ...
3
votes
2answers
828 views

Security of AES in CTR mode with fixed nonce (but different key)

If I am using AES in CTR mode and use a unique key every time but the same nonce, is this secure? If so, does it make a difference if the nonce is public?
0
votes
1answer
220 views

AES-CTR authentication salt+HMAC(ciphertext) OR HMAC(salt+ciphertext)

Which one of these functions are preferred for authenticating AES-CTR? ...
0
votes
1answer
117 views

Arbitrary length to multiple of block size

I would like to apply CTR mode on a arbitrary length which isn't multiple of block size. Is this possible without applying padding. In case we apply padding - how does the decryption algorithm know ...
1
vote
2answers
1k views

CTR Mode and Chosen Plaintext Attacks

P.71 of Cryptography Engineeering states "Any weakness in CTR encryption mode immediately implies a chosen plaintext attack on the block cipher." It seems to me that "any weakness" is vague. I'm not ...
0
votes
2answers
217 views

Is it safe to use a MAC as iv for CTR encoding?

I have devised the following encryption algorithm and would like to know if it is safe. The goal is to use it to encrypt cookie values. I thus want to keep the encoding overhead as small as possible. ...
1
vote
1answer
1k views

CTR and CBC-MAC Demystified

I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost. According to the CCMP Encapsulation block diagram there are inputs like ...
1
vote
1answer
856 views

How to increment the counter value for CTR mode?

I am testing CTR mode on STM32 board. I want to know how the auto increment of counter happens and what is the method to follow if I have to increment the counter manually.
2
votes
1answer
2k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
0
votes
1answer
472 views

Generating 64 bit random values using AES-CTR

I need to generate 64 bit random values using AES-CTR. Using fixed 64 bit plain text and sequential nonces can I assume the higher order 64 bit output values of the AES-CTR to be random with a ...
1
vote
1answer
819 views

NIST's Methods for Key Wrapping?

NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
0
votes
1answer
427 views

Enc-Mac (AES CTR+CBC) mixing AES-256 and AES-128 and splitting keys

I'm looking to accomplish a Enc-then-Mac approach using AES-CTR and ECBC-MAC Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag. If I do this: Use AES256-CTR for the ...
7
votes
1answer
2k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
6
votes
3answers
976 views

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

The embedded device is a low-power 8-bit microcontroller (memory usage is constrained to about 10kb code, 1kb ram). As the device is battery-powered and manual service should be minimal, more powerful ...
1
vote
2answers
750 views

Is there a form of AES encryption where the cipher text matches the length of the clear text and does not show patterns?

I have clear text, usually less than 10 bytes, which contains a few infrequently changing bytes. Reading: http://lollyrock.com/articles/nodejs-encryption/ I tried ...
3
votes
2answers
627 views

Can CTR mode be used with public key cryptography?

Can counter mode be used in some way in public key cryptography? Can we decrypt when counter mode is used if 1. we have the key and 2. we have the cipher text? Is there any other mode in which this is ...
1
vote
1answer
346 views

CTR vs CBC cycles per byte with OpenSSL EVP

I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption. (1) : I got 3.2 Cycles/Byte for CBC encryption. (2) : I got 0.7 Cycles/Byte for CBC decryption, CTR ...
5
votes
1answer
1k views

IND-CPA security of CTR mode

Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
3
votes
1answer
191 views

Deterministic encryption for a limited space: using HMAC as IV [duplicate]

I need a deterministic encryption scheme. Objectives: Same plaintext is always encrypted to the same ciphertext. Related plaintexts are encrypted to unrelated ciphertexts. (For example, attacker that ...
6
votes
3answers
570 views

Can I create a random access CSPRNG from a hash?

Can I use a keyed hash of a counter as a secure CSPRNG? E.g. 4th random block is Hash(4, seed) If not, what are the possible attacks?
0
votes
2answers
1k views

Encrypting small packets with low data rate

I'm trying to build my own layer of encryption on top of our bluetooth communication. We can't use bonding because of some specific features we need to support. I'm a beginner when it comes to ...