Skip to main content
16 votes
Accepted

Disadvantages of AES-CTR?

Disadvantages: Message length: In Cryptography, usually, the message length is not considered secret. There are approaches that you can add random values to the end or beginning or both if this is ...
kelalaka's user avatar
  • 49k
13 votes
Accepted

Relationship between AES GCM and AES CTR

That's correct. In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
Ruggero's user avatar
  • 7,104
13 votes
Accepted

What are the risks of using CTR mode with 64 bit blocks?

I believe that he was referring to the misconception that the birthday problem that arises in encryption is only when you use the same counter twice. If a random IV is used, then such a counter ...
Yehuda Lindell's user avatar
13 votes
Accepted

Would an encryption-only block cipher be useful at all?

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption), Block cipher is a synonym for Pseudo Random ...
kelalaka's user avatar
  • 49k
11 votes
Accepted

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

Yes, but to use a known algorithm that specifies precisely that, take a look at the SIV mode of operation . "SIV" stands for Synthetic IV. IV is the initialization vector, which is the nonce ...
Maarten Bodewes's user avatar
  • 93.2k
11 votes
Accepted

Can we use a sort of "hash" function in CTR mode instead of a block cipher?

Your intuition is on the right track: if you run a pseudorandom function in counter mode with your secret key, you get a stream cipher. Some stream ciphers are designed like this, perhaps most ...
Luis Casillas's user avatar
10 votes

mode of operation in cryptography

You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
Maarten Bodewes's user avatar
  • 93.2k
10 votes

mode of operation in cryptography

I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
mikeazo's user avatar
  • 38.7k
10 votes
Accepted

Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

I understand that it would be quite inefficient as the key schedule would need to be re-calculated for every block, but would it make cryptanalysis easier? It would make cryptanalysis trivial. If ...
poncho's user avatar
  • 148k
9 votes

How to Implement Deterministic Encryption Safely in .NET

You can safely use HMAC-SHA256 instead of the SIV mode custom PRF to derive the nonce/authentication tag. There's some caveats: HMAC-SHA256 gives a 256-bit output; you'll have to truncate it to the ...
Squeamish Ossifrage's user avatar
8 votes
Accepted

Using checksum instead of hash for authenticating ciphers

If we were to use CTR, what would you think of using a checksum on plain text then encrypt whole. That's a really bad idea (from a security perspective). Here are the reasons for this: Depending ...
SEJPM's user avatar
  • 46.1k
8 votes

What are the risks of using CTR mode with 64 bit blocks?

This answer summarizes what's achieved against CTR mode in the paper pointed by Yehuda Lindell's answer: Gaëtan Leurent and Ferdinand Sibleyras's The Missing Difference Problem, and its Applications ...
fgrieu's user avatar
  • 142k
8 votes
Accepted

AES-128/CTR/NoPadding HMAC vs Signature

Yes, there is an important one; The Non-Repudiation; Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated ...
kelalaka's user avatar
  • 49k
8 votes
Accepted

How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?

Using AES-128 with only 64-bit uniform random is not secure. There are many entities around that can break this easily by searching the $2^{64}$- space. Machines in a second in an hour in a day in a ...
kelalaka's user avatar
  • 49k
7 votes

How is decryption done in AES CTR mode?

A slight correction about terminology: The key is constant when you use CTR. The IV/counter affect the cipher input and so the keystream varies. The reason this can be decrypted is that the ...
otus's user avatar
  • 32.2k
7 votes
Accepted

CPA-security of CTR mode

One gap in your proposed argument is that $ctr$ is known to the adversary (it is included in the ciphertext), whereas saying "$G_k(ctr)$ is pseudorandom" implicitly assumes that both $k$ and $ctr$ are ...
Chris Peikert's user avatar
7 votes
Accepted

Can I create a random access CSPRNG from a hash?

There is a name for "random access PRG" : it's called a pseudorandom function (PRF). Any block cipher is a pseudorandom function (that's more-or-less the definition of what it means to be a secure ...
Mikero's user avatar
  • 13.5k
7 votes
Accepted

Hashing a counter to prevent distinguishers in CTR mode

I'm reading the question as generating a keystream per: $S_i\gets E_K(F(\mathrm{IV},i))$ where $F$ is a public function built from a hash function; for incremental index $i$ starting from $0$ and ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

Is it safe to reuse the password when using AES-CTR with scrypt?

CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero ...
Conrado's user avatar
  • 6,484
6 votes
Accepted

Strength of Sha512Ctr PRNG

Your proposal is more or less what NIST SP 800-90A describes as "Hash_DRBG". From a pure cryptographic point of view, there's nothing bad with it. A few remarks can be made from a more engineering ...
Thomas Pornin's user avatar
6 votes
Accepted

What is the maximum number of messages that can be encrypted using the same key for CTR mode?

You should generally keep the total volume of data encrypted well below $2^{64}$ blocks per key with AES-CTR (or any use of AES)—for example, a petabyte ($2^{50}$) per key is a reasonable limit. This ...
Squeamish Ossifrage's user avatar
6 votes

Using 0 nonce for AES-256 in CTR mode

There will no problem with using the nonce as 0 but only for once with the same key as the nonce says number used once. Remember ...
kelalaka's user avatar
  • 49k
6 votes
Accepted

AES-CTR security if S-boxes substituion is omitted?

An Sbox is a necessary condition for the security of the AES or a similar block cipher but may not be sufficient. We can list all AES operations on a high level as SubBytes – a non-linear ...
kelalaka's user avatar
  • 49k
6 votes

What input parameters can be made public in the AES-CTR mode?

In AES-CTR, the nonce is extended to 128-bit (unless it's already that size) by padding zeroes, and is the initial value of the counter. The counter evolves in a public manner (incremented by one at ...
fgrieu's user avatar
  • 142k
5 votes

AES CTR with a non random and predictable nonce?

For CTR mode, a random IV is not needed. The only requirement be that the counter be unique in each block over all encryptions. (This is in contrast to CBC mode where unpredictability of the IV is ...
Yehuda Lindell's user avatar
5 votes
Accepted

encryption of digest of unkeyed hash function is susceptible to forgery?

An attacker can trivial forge the MAC of any message, given one valid MAC of a known message, in either CBC mode or CTR mode. Let us assume that the attacker knows a message $m$ and its MAC $E(k, H(m)...
poncho's user avatar
  • 148k
5 votes

Can CTR mode be used with public key cryptography?

I interpret your question to be asking "Can we directly use public key encryption algorithms with a CTR-like mode?", as opposed to "is it possible to perform a key exchange via RSA and use AES-CTR?" (...
Ella Rose's user avatar
  • 19.7k
5 votes

Security of non-standard use for AES-256-CTR?

This is insecure if more than a single secret is processed with the same password. Plus, OpenSSL has abysmally insufficient key stretching in its processing of the password, making brute force ...
fgrieu's user avatar
  • 142k
5 votes

Why does CTR mode become insecure after $2^{0.5 \times n}$ blocks?

The security proof and bounds, such as those on page 18 of BDJR's 97 paper, can be read to derive some understanding of what going beyond the bound means. At a high level, the notion is that you ...
Thomas M. DuBuisson's user avatar
5 votes
Accepted

AES CTR: Random IV

Is there an official document that states, that using a random IV for a fixed key is a valid approach (not just a so answer :)) The NIST 800-38a states what you need and remember the problem occurs ...
kelalaka's user avatar
  • 49k

Only top scored, non community-wiki answers of a minimum length are eligible