Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
3
votes
1answer
525 views

AES CTR with a non random and predictable nonce?

after reading a lot of stuff about AES CTR and its IV i'm still not sure if it is ok to use a predictable IV or not. I searched the web and found some programs / devices that use encryption in this ...
2
votes
1answer
170 views

Relevance of Input and Ouput size of PRF on CTR mode

I'm working on exercise 3.25 on Katz' book (2nd ed): Let $F$ be a pseudorandom function such that for $k \in \{0, 1\}^n$ the function $F_k$ maps $\ell_{\text{in}}(n)$-bit inputs to $\ell_{\text{out}...
7
votes
1answer
1k views

CPA-security of CTR mode

I'm self-studying Katz' book (2nd ed), and I have a small question about Theorem 3.32, which says: If $F$ is a pseudorandom permutation, then $CTR$ mode is $CPA-$secure. They present a proof there,...
4
votes
1answer
485 views

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 ...
1
vote
3answers
3k views

Pseudo code for CTR mode encryption

I am following a document here about CTR mode of encryption. I have some point uncleared. At the part 1 Review of Counter-Mode Encryption. Operation. To encrypt using CTR-mode encryption, one ...
0
votes
1answer
151 views

Break AES-CFB mode having access to a AES-CTR black box

I need help for a "simple" problem Let's suppose an intercepted ciphertext C encrypted with an AES-CFB mode of operation, using key K and some IV (IV is probably at the begining of C) The system let ...
6
votes
2answers
380 views

Is it feasable to combine ECB and CTR block modes of operation?

Both ECB and CTR block modes have advantages over other block modes. They both support parallel encryption and decryption and random reads/writes. Yet both have major disadvantages: (I'm assuming AES ...
0
votes
1answer
2k views

Is openssl library safe threaded? [closed]

I'm encrypting in C++ with openssl library. Basically I'm using these functions: RAND_bytes(key, 32); AES_set_encrypt_key(...) AES_ctr128_encrypt(...) My purpose is to encrypt parallelly with ...
1
vote
0answers
150 views

Dangers of using AES CTR without authentication - can you recover the plain text?

I understand that if a system uses AES in CTR mode (or other modes) without authentication that an attacker can flip bits to try to get the system to do something it wasn't intended to do (or wasn't ...
1
vote
1answer
998 views

Counter Mode Known plain text attacks

Counter mode uses a counter that is incremented for each block. Doesnt predictability of this counter expose the scheme to attack? I mean if you are incrementing some nonce, then I have a good chance ...
37
votes
1answer
54k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
2
votes
1answer
279 views

encryption of digest of unkeyed hash function is susceptible to forgery?

I have a question in mind. Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the following way, ...
2
votes
1answer
2k views

Repeated NONCE in CTR mode

My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
0
votes
1answer
152 views

Questions regarding parallel AES CTR with merkle trees

I'm planning to implement a parallelizable variant of AES to end-to-end-encrypt files in a web application. As a mode of operation I'm most likely gonna use CTR mode with a 64 bit IV and 64 bit ...
7
votes
1answer
704 views

Can we use a sort of “hash” function in CTR mode instead of a block cipher? [duplicate]

CTR mode does not use the decryption function at all, only the encryption function. This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
1
vote
0answers
60 views

Authenticating a range of a ciphertext

I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
1
vote
3answers
2k views

CTR HMAC SHA256 implementation

After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR with HMAC SHA256. From what I understand, I can use the IV as a counter, and the IV only ...
2
votes
1answer
1k views

Security of AES CTR with multiple messages containing the same known plain text

I have this scenario: The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using ...
1
vote
2answers
431 views

mode of operation in cryptography

We need to choose a mode of operation for a Telnet like application where the average message size is between 7 and 1024 bytes. What is the best mode of operation in this case? a. CBC b. CFB c. ...
2
votes
1answer
11k views

How is decryption done in AES CTR mode?

Since AES CTR mode uses a unique IV and counter to produce the key to XOR with the plain text to get the ciphertext, the question is so as to how decryption is done. Since AES CTR produces a ...
3
votes
1answer
18k views

Is regular CTR mode vulnerable to any attacks?

Regular plain CTR mode, is it vulnerable to any attack? I plan to write a program to encrypt a drive with ctr mode. Would this be wise? Would AES be better? When I look at this diagram, it looks ...
-1
votes
1answer
275 views

I homebrewed an algorithm. Is it secure?

This is a bit of a cross-posted question which I first asked at StackOverflow, however I was not satisfied with stackoverflow, so I came here for an in depth answer. I, as they say, "rolled my own ...
6
votes
1answer
178 views

Streaming mode of operation that is more resistant against nonce reuse

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality? In this question it would be allowed for the streaming mode to leak if ciphertexts ...
1
vote
1answer
638 views

Dangers of using CTR mode for encryption

I know that it is never suggested to use the same key or key/IV pair twice for a stream cipher or for a block cipher operating in CTR mode. Filesystem-level encryption reuses the same key for a file ...
10
votes
3answers
2k views

AES CTR with similar IVs and same key

Let's say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs. So for example, a 16 byte IV, the 2nd 8 bytes are always ...
18
votes
2answers
8k views

Why do we use XTS over CTR for disk encryption?

I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption. It seems that CTR mode would do exactly what XTS can do, but is simpler to ...
6
votes
1answer
725 views

Multi-target attacks on AES-CTR with a random nonce

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ...,k_{2^{40}}...
5
votes
1answer
450 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ is a nonce $m$...
3
votes
1answer
1k views

CTR DRBG dependent on request size?

I am trying to understand the CTR DRBG specification in NIST SP 800-90A. It seems slightly different to a pure stream cipher in that the key and counter are reset after each generate call using the ...
0
votes
1answer
433 views

If PRF is non invertible, why does Ctr-mode work?

I am currently taking Dan Boneh's Cryptography I course online. I have just finished the segment discussing the Cipher Block Chaining and Counter-Mode. I am having difficulty understanding why Ctr-...
2
votes
1answer
1k views

Best practises to generate IV for AES-CTR in this scenario

I'm building a cloud storage application that will store files on my servers. I want these files to be encrypted with AES in CTR mode and the key will be always the same. I'm wondering what would be ...
3
votes
2answers
859 views

Do I need an IV to use AES-CTR as a CSPRNG?

I'm using AES128-CTR for generating pseudo-random values, which is considered secure for up to 1MB (at least from what I've read). I simply encrypt a 128-bit little-endian counter, starting from 0. ...
7
votes
2answers
2k views

Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says: A nonce N of 15-L octets. Within the ...
5
votes
1answer
573 views

Implementing 5 modes of operation with a hash function

Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
1
vote
2answers
763 views

(Re-)Using deterministic IV in CTR mode / How to: deterministic AES

I am aware of the requirement of an IV to be unique in CTR mode (Why must IV/key-pairs not be reused in CTR mode?). However I wonder if I can use an IV depending on the plaintext deterministically. ...
0
votes
1answer
594 views

Explain same encryption time for two files of different sizes

I am encrypting files in a two layered fashion as follows: Inner layer is 128 bit AES-CTR encryption Outer/Second layer is a simple one time padding with a particular key. While testing the running ...
4
votes
2answers
504 views

AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
4
votes
2answers
966 views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
6
votes
5answers
5k views

AES decryption vs encryption speed

Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?
3
votes
2answers
489 views

Does CTR mode yield a PRF?

Can the keystream generated by CTR mode be considered a pseudo-random function? I give more information. Assume $f$ is a PRF. We define a function which takes 2 inputs, the desired length, and an ...
3
votes
1answer
714 views

File encryption with AES CTR mode

I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. ...
7
votes
3answers
970 views

Why is it good to split a CTR-mode counter into nonce and counter?

When discussing the CTR mode of block ciphers, Wikipedia says the following: Simply adding or XORing the nonce and counter into a single value would completely break the security under a chosen-...
10
votes
1answer
6k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
2
votes
2answers
229 views

Is this commutative encryption protocol secure?

My assumptions are: encryption must be commutative man-in-the-middle is not an issue I would like to implement the following scheme between 2 parties ($A$ and $B$) to exchange a key: Lets $C = P \...
7
votes
2answers
428 views

Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
1
vote
2answers
878 views

Secure Channel - Encryption and Decryption Keys For A Message

I'm currently reading Cryptography Engineering and in Chapter 7, the topic of secure channel is discussed. The channel described is using CTR for encryption. Below I include images with pseudo-code ...
1
vote
1answer
530 views

CTR_DRBG versus OFB_DRBG

As far as I know, in the development of ANSI X9.82, there was consideration of OFB_DRBG, a pseudorandom number generator based on block ciphers like CTR_DRBG, but it appears to have been rejected of ...
6
votes
1answer
453 views

Is it possible to combine true streaming with AEAD?

It seems there is a difference between "streaming" in cryptographic sense (as in CTR) and "streaming" in general programming sense (as in "accept a file larger than RAM from socket and save it on disk"...
-1
votes
1answer
775 views

credit card number encryption using aes-ctr mode

I want to encrypt credit card numbers. I want to apply AES-CTR mode. Is it suitable for that? How can I store nonce and counter values for an individual credit card number? How can I send the ...
6
votes
2answers
2k views

How do we compute IV+1 in CTR mode?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...