Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Filter by
Sorted by
Tagged with
5
votes
2answers
659 views

Security of non-standard use for AES-256-CTR?

I have a string secret that I would like to encrypt for storage in a Yubikey's second slot. These slots can be configured to store up to 38 characters that are later "typed" by the USB device acting ...
2
votes
0answers
206 views

AES-CTR and AES-CMAC using the same temporary key

Is it a severe security issue using a short-lived dynamic key for both AES-CTR and AES-CMAC? CMAC is generated on the cleartext and 32 bit of it are attached to the message (MAC-and-Encrypt) The key ...
3
votes
2answers
680 views

Security of AES in CTR mode with fixed nonce (but different key)

If I am using AES in CTR mode and use a unique key every time but the same nonce, is this secure? If so, does it make a difference if the nonce is public?
0
votes
1answer
178 views

AES-CTR authentication salt+HMAC(ciphertext) OR HMAC(salt+ciphertext)

Which one of these functions are preferred for authenticating AES-CTR? ...
0
votes
1answer
83 views

Arbitrary length to multiple of block size

I would like to apply CTR mode on a arbitrary length which isn't multiple of block size. Is this possible without applying padding. In case we apply padding - how does the decryption algorithm know ...
1
vote
2answers
800 views

CTR Mode and Chosen Plaintext Attacks

P.71 of Cryptography Engineeering states "Any weakness in CTR encryption mode immediately implies a chosen plaintext attack on the block cipher." It seems to me that "any weakness" is vague. I'm not ...
0
votes
2answers
187 views

Is it safe to use a MAC as iv for CTR encoding?

I have devised the following encryption algorithm and would like to know if it is safe. The goal is to use it to encrypt cookie values. I thus want to keep the encoding overhead as small as possible. ...
1
vote
1answer
729 views

CTR and CBC-MAC Demystified

I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost. According to the CCMP Encapsulation block diagram there are inputs like ...
1
vote
1answer
2k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
0
votes
1answer
621 views

NIST's Methods for Key Wrapping?

NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
4
votes
1answer
1k views

How to make cookies tamper-proof and secure by using encryption and hash / MAC

Our company has decided to ditch server side sessions in favor of storing authenticated information such as user id and access privilege information in a cookie. Before everyone jumps up and down ...
0
votes
1answer
376 views

Generating 64 bit random values using AES-CTR

I need to generate 64 bit random values using AES-CTR. Using fixed 64 bit plain text and sequential nonces can I assume the higher order 64 bit output values of the AES-CTR to be random with a ...
0
votes
1answer
370 views

Enc-Mac (AES CTR+CBC) mixing AES-256 and AES-128 and splitting keys

I'm looking to accomplish a Enc-then-Mac approach using AES-CTR and ECBC-MAC Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag. If I do this: Use AES256-CTR for the ...
7
votes
1answer
2k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
1
vote
2answers
568 views

Is there a form of AES encryption where the cipher text matches the length of the clear text and does not show patterns?

I have clear text, usually less than 10 bytes, which contains a few infrequently changing bytes. Reading: http://lollyrock.com/articles/nodejs-encryption/ I tried ...
3
votes
2answers
407 views

Can CTR mode be used with public key cryptography?

Can counter mode be used in some way in public key cryptography? Can we decrypt when counter mode is used if 1. we have the key and 2. we have the cipher text? Is there any other mode in which this is ...
1
vote
1answer
296 views

CTR vs CBC cycles per byte with OpenSSL EVP

I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption. (1) : I got 3.2 Cycles/Byte for CBC encryption. (2) : I got 0.7 Cycles/Byte for CBC decryption, CTR ...
4
votes
1answer
687 views

IND-CPA security of CTR mode

Let's suppose CTR mode is instantiated such that the input to the block-cipher is $\langle \mathrm{IV}+\mathrm{ctr}\rangle$ instead of $\mathrm{IV}\mathbin\|\langle \mathrm{ctr}\rangle$, where $\...
3
votes
1answer
151 views

Deterministic encryption for a limited space: using HMAC as IV [duplicate]

I need a deterministic encryption scheme. Objectives: Same plaintext is always encrypted to the same ciphertext. Related plaintexts are encrypted to unrelated ciphertexts. (For example, attacker that ...
6
votes
3answers
522 views

Can I create a random access CSPRNG from a hash?

Can I use a keyed hash of a counter as a secure CSPRNG? E.g. 4th random block is Hash(4, seed) If not, what are the possible attacks?
3
votes
1answer
445 views

AES CTR with a non random and predictable nonce?

after reading a lot of stuff about AES CTR and its IV i'm still not sure if it is ok to use a predictable IV or not. I searched the web and found some programs / devices that use encryption in this ...
0
votes
2answers
960 views

Encrypting small packets with low data rate

I'm trying to build my own layer of encryption on top of our bluetooth communication. We can't use bonding because of some specific features we need to support. I'm a beginner when it comes to ...
2
votes
1answer
124 views

Relevance of Input and Ouput size of PRF on CTR mode

I'm working on exercise 3.25 on Katz' book (2nd ed): Let $F$ be a pseudorandom function such that for $k \in \{0, 1\}^n$ the function $F_k$ maps $\ell_{\text{in}}(n)$-bit inputs to $\ell_{\text{out}...
5
votes
1answer
867 views

CPA-security of CTR mode

I'm self-studying Katz' book (2nd ed), and I have a small question about Theorem 3.32, which says: If $F$ is a pseudorandom permutation, then $CTR$ mode is $CPA-$secure. They present a proof there,...
3
votes
1answer
637 views

Using checksum instead of hash for authenticating ciphers

Lets assume for a specific situation we cannot use authenticated encryption like GCM ... If we were to use CTR, what would you think of using a checksum on the plaintext then encrypt the whole. The ...
4
votes
1answer
469 views

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 ...
2
votes
1answer
134 views

Why does the authenticated cipher CCM encrypt the MAC too?

Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC? In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks". But I can not ...
1
vote
3answers
2k views

Pseudo code for CTR mode encryption

I am following a document here about CTR mode of encryption. I have some point uncleared. At the part 1 Review of Counter-Mode Encryption. Operation. To encrypt using CTR-mode encryption, one ...
0
votes
1answer
122 views

Break AES-CFB mode having access to a AES-CTR black box

I need help for a "simple" problem Let's suppose an intercepted ciphertext C encrypted with an AES-CFB mode of operation, using key K and some IV (IV is probably at the begining of C) The system let ...
0
votes
1answer
1k views

Is openssl library safe threaded? [closed]

I'm encrypting in C++ with openssl library. Basically I'm using these functions: RAND_bytes(key, 32); AES_set_encrypt_key(...) AES_ctr128_encrypt(...) My purpose is to encrypt parallelly with ...
1
vote
0answers
125 views

Dangers of using AES CTR without authentication - can you recover the plain text?

I understand that if a system uses AES in CTR mode (or other modes) without authentication that an attacker can flip bits to try to get the system to do something it wasn't intended to do (or wasn't ...
5
votes
2answers
305 views

Is it feasable to combine ECB and CTR block modes of operation?

Both ECB and CTR block modes have advantages over other block modes. They both support parallel encryption and decryption and random reads/writes. Yet both have major disadvantages: (I'm assuming AES ...
1
vote
1answer
825 views

Counter Mode Known plain text attacks

Counter mode uses a counter that is incremented for each block. Doesnt predictability of this counter expose the scheme to attack? I mean if you are incrementing some nonce, then I have a good chance ...
2
votes
1answer
254 views

encryption of digest of unkeyed hash function is susceptible to forgery?

I have a question in mind. Suppose we have a collision-resistant unkeyed-hash function $H(·)$ which outputs a 128-bit digest, and a semantic secure symmetric encryption $E(·,·)$ in the following way, ...
2
votes
1answer
1k views

Repeated NONCE in CTR mode

My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
0
votes
1answer
130 views

Questions regarding parallel AES CTR with merkle trees

I'm planning to implement a parallelizable variant of AES to end-to-end-encrypt files in a web application. As a mode of operation I'm most likely gonna use CTR mode with a 64 bit IV and 64 bit ...
6
votes
1answer
484 views

Can we use a sort of “hash” function in CTR mode instead of a block cipher? [duplicate]

CTR mode does not use the decryption function at all, only the encryption function. This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
1
vote
0answers
59 views

Authenticating a range of a ciphertext

I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
4
votes
1answer
392 views

What is the LENGTH parameter in EEA2?

In the EEA2 option for encryption in LTE the AES-128 algorithm is mechanized. There, the nonce used in the CTR Mode is a 128-bit value. The first 64-bits are covered by a COUNTER, a BEARER, a ...
2
votes
1answer
147 views

Why is a one-time MAC secure for MAC-then-encrypt with randomized-CTR but not randomized-CBC?

The Coursera cryptography 1 course says: If you want to use MAC-then-encrypt mode then you should either use randomized-CTR or randomized-CBC. And if you use randomized-CTR then one-time-MAC ...
1
vote
1answer
738 views

How to increment the counter value for CTR mode?

I am testing CTR mode on STM32 board. I want to know how the auto increment of counter happens and what is the method to follow if I have to increment the counter manually.
2
votes
1answer
898 views

Security of AES CTR with multiple messages containing the same known plain text

I have this scenario: The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using ...
2
votes
1answer
8k views

How is decryption done in AES CTR mode?

Since AES CTR mode uses a unique IV and counter to produce the key to XOR with the plain text to get the ciphertext, the question is so as to how decryption is done. Since AES CTR produces a ...
1
vote
2answers
422 views

mode of operation in cryptography

We need to choose a mode of operation for a Telnet like application where the average message size is between 7 and 1024 bytes. What is the best mode of operation in this case? a. CBC b. CFB c. ...
7
votes
1answer
803 views

Security of a simple AEAD construction

Introduction I want securely communicate with a small 8-bit device which has a very limited program program memory (Arduino Uno - 32K). My goal is to minimize code size and RAM usage. There are ...
-1
votes
1answer
269 views

I homebrewed an algorithm. Is it secure?

This is a bit of a cross-posted question which I first asked at StackOverflow, however I was not satisfied with stackoverflow, so I came here for an in depth answer. I, as they say, "rolled my own ...
2
votes
1answer
14k views

Is regular CTR mode vulnerable to any attacks?

Regular plain CTR mode, is it vulnerable to any attack? I plan to write a program to encrypt a drive with ctr mode. Would this be wise? Would AES be better? When I look at this diagram, it looks ...
1
vote
1answer
551 views

Dangers of using CTR mode for encryption

I know that it is never suggested to use the same key or key/IV pair twice for a stream cipher or for a block cipher operating in CTR mode. Filesystem-level encryption reuses the same key for a file ...
6
votes
1answer
558 views

Multi-target attacks on AES-CTR with a random nonce

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ...,k_{2^{40}}...
5
votes
1answer
398 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...