Hot answers tagged

28 votes
Accepted

Is regular CTR mode vulnerable to any attacks?

Summing up the discussion in the comments: What you are describing is the CTR Mode of operation of block ciphers, which requires an encryption function ("E" in your diagram) like AES. So, "should I ...
user avatar
  • 1,400
15 votes
Accepted

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

Short answer: There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting ...
user avatar
  • 1,928
13 votes
Accepted

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

AES-CTR is a stream cipher, of a particular kind where the keystream is obtained by encryption of a counter. So the question reduces to: what are drawbacks of AES-CTR compared to other stream ciphers? ...
user avatar
  • 124k
13 votes
Accepted

What are the risks of using CTR mode with 64 bit blocks?

I believe that he was referring to the misconception that the birthday problem that arises in encryption is only when you use the same counter twice. If a random IV is used, then such a counter ...
user avatar
13 votes
Accepted

Disadvantages of AES-CTR?

Disadvantages: Message length: In Cryptography, usually, the message length is not considered secret. There are approaches that you can add random values to the end or beginning or both if this is ...
user avatar
  • 43.4k
12 votes
Accepted

How do we compute IV+1 in CTR mode?

The reference for this is NIST SP800-38A, especially its appendix B. Basically we consider the IV a binary value of the width of the block cipher (64-bit for DES, 128-bit for AES), and add 1 to that, ...
user avatar
  • 124k
11 votes
Accepted

Can we use a sort of "hash" function in CTR mode instead of a block cipher?

Your intuition is on the right track: if you run a pseudorandom function in counter mode with your secret key, you get a stream cipher. Some stream ciphers are designed like this, perhaps most ...
user avatar
10 votes

mode of operation in cryptography

I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
user avatar
  • 37.7k
10 votes

mode of operation in cryptography

You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
user avatar
  • 85.1k
10 votes
Accepted

Relationship between AES GCM and AES CTR

That's correct. In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
user avatar
  • 6,329
10 votes
Accepted

Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

I understand that it would be quite inefficient as the key schedule would need to be re-calculated for every block, but would it make cryptanalysis easier? It would make cryptanalysis trivial. If ...
user avatar
  • 132k
9 votes

Why isn't CTR mode (counter mode) used more often?

There are probably quite a few good reasons for this, although I don't expect that a scientific answer can be composed (as you would need to use a survey, and I've never heard of such a thing for ...
user avatar
  • 85.1k
9 votes
Accepted

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

Yes, but to use a known algorithm that specifies precisely that, take a look at the SIV mode of operation . "SIV" stands for Synthetic IV. IV is the initialization vector, which is the nonce ...
user avatar
  • 85.1k
9 votes

How to Implement Deterministic Encryption Safely in .NET

You can safely use HMAC-SHA256 instead of the SIV mode custom PRF to derive the nonce/authentication tag. There's some caveats: HMAC-SHA256 gives a 256-bit output; you'll have to truncate it to the ...
user avatar
8 votes
Accepted

Does AES CTR mode store header information in encrypted files?

I would like to ask if that is true for every AES CTR mode implementation?, Doesn't have to be. You can store the nonce anywhere. You could even send it to the recipient via a different channel (e.g....
user avatar
  • 37.7k
8 votes
Accepted

Implementing 5 modes of operation with a hash function

The modes you are referencing are specifically modes of operations for block ciphers, and therefore are not directly applicable to hash functions. Block cipher operations take 2 inputs, the key and a ...
user avatar
  • 12.7k
8 votes
Accepted

Using checksum instead of hash for authenticating ciphers

If we were to use CTR, what would you think of using a checksum on plain text then encrypt whole. That's a really bad idea (from a security perspective). Here are the reasons for this: Depending ...
user avatar
  • 44.6k
7 votes

Random Number Generator based on AES CTR

First, the obvious advice is not to use this in practice. Rolling your own is fine for learning, but you should use standard primitives when you need actual security. E.g. one from SP 800-90A which ...
user avatar
  • 31.3k
7 votes
Accepted

Strategy for random CTR initial counter values

Let $2^m$ be the average message length in blocks. When using an independent random nonce for the whole 128-bit IV of each block, you would expect a collision after $2^{64}$ blocks, i.e. $2^{64-m}$ ...
user avatar
  • 31.3k
7 votes
Accepted

Are all stream-ciphers IND-CPA?

No. There is a difference between the type of a cipher and the construction of a cipher. If a cipher is of a specific type for which there are known IND-CPA secure constructions then that doesn't ...
user avatar
  • 85.1k
7 votes

Does CTR mode yield a PRF?

It is not accurate to say that the keystream from AES-CTR is a pseudorandom function. However, it is a pseudorandom generator. Furthermore, the construction that you gave is close to working but it's ...
user avatar
7 votes

AES decryption vs encryption speed

Given the choice, it is preferable to use the block encryption operation of AES, since it often faster than block decryption (never slower AFAIK). For this reason, AES-CTR is defined to use the block ...
user avatar
  • 124k
7 votes

How is decryption done in AES CTR mode?

A slight correction about terminology: The key is constant when you use CTR. The IV/counter affect the cipher input and so the keystream varies. The reason this can be decrypted is that the ...
user avatar
  • 31.3k
7 votes
Accepted

CPA-security of CTR mode

One gap in your proposed argument is that $ctr$ is known to the adversary (it is included in the ciphertext), whereas saying "$G_k(ctr)$ is pseudorandom" implicitly assumes that both $k$ and $ctr$ are ...
user avatar
7 votes
Accepted

Can I create a random access CSPRNG from a hash?

There is a name for "random access PRG" : it's called a pseudorandom function (PRF). Any block cipher is a pseudorandom function (that's more-or-less the definition of what it means to be a secure ...
user avatar
  • 10.6k
7 votes

What are the risks of using CTR mode with 64 bit blocks?

This answer summarizes what's achieved against CTR mode in the paper pointed by Yehuda Lindell's answer: Gaëtan Leurent and Ferdinand Sibleyras's The Missing Difference Problem, and its Applications ...
user avatar
  • 124k
7 votes
Accepted

Hashing a counter to prevent distinguishers in CTR mode

I'm reading the question as generating a keystream per: $S_i\gets E_K(F(\mathrm{IV},i))$ where $F$ is a public function built from a hash function; for incremental index $i$ starting from $0$ and ...
user avatar
  • 124k
7 votes
Accepted

Is it safe to reuse the password when using AES-CTR with scrypt?

CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero ...
user avatar
  • 6,109
6 votes

How can one parallelize tasks in CTR-AES for maximum performance?

From the diagram on CTR mode you can notice that there are no dependencies between any of the phases of the pipeline. If you have more than one block-size worth of data, you can process each block-...
user avatar
6 votes
Accepted

What's the advantage of using OFB/CFB/CTR modes over a stream cipher

There is no real advantage, other than the fact that it allows you to convert a block cipher into a stream cipher securely. Since there has been a large amount of research put into block ciphers and ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible