28
votes
Accepted
Is regular CTR mode vulnerable to any attacks?
Summing up the discussion in the comments: What you are describing is the CTR Mode of operation of block ciphers, which requires an encryption function ("E" in your diagram) like AES. So, "should I ...
- 1,420
13
votes
Accepted
What does a stream cipher provide that cannot be obtained with AES CTR mode operation?
AES-CTR is a stream cipher, of a particular kind where the keystream is obtained by encryption of a counter. So the question reduces to: what are drawbacks of AES-CTR compared to other stream ciphers?
...
- 132k
13
votes
Accepted
What are the risks of using CTR mode with 64 bit blocks?
I believe that he was referring to the misconception that the birthday problem that arises in encryption is only when you use the same counter twice. If a random IV is used, then such a counter ...
- 27.3k
13
votes
Accepted
Disadvantages of AES-CTR?
Disadvantages:
Message length: In Cryptography, usually, the message length is not considered secret. There are approaches that you can add random values to the end or beginning or both if this is ...
- 45.7k
12
votes
Accepted
Relationship between AES GCM and AES CTR
That's correct.
In most cases you can do what you are proposing. However be warned that by disregarding the authentication you clearly loose message authentication and bit flipping in AES-CTR ...
- 6,754
11
votes
Accepted
Can we use a sort of "hash" function in CTR mode instead of a block cipher?
Your intuition is on the right track: if you run a pseudorandom function in counter mode with your secret key, you get a stream cipher. Some stream ciphers are designed like this, perhaps most ...
- 14.3k
11
votes
Accepted
Can I use MAC as CTR mode nonce, if my messages are non-repeating?
Yes, but to use a known algorithm that specifies precisely that, take a look at the SIV mode of operation . "SIV" stands for Synthetic IV. IV is the initialization vector, which is the nonce ...
- 89.3k
11
votes
Accepted
Would an encryption-only block cipher be useful at all?
Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),
Block cipher is a synonym for Pseudo Random ...
- 45.7k
10
votes
mode of operation in cryptography
I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
- 38.2k
10
votes
mode of operation in cryptography
You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
- 89.3k
10
votes
Accepted
Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$
I understand that it would be quite inefficient as the key schedule would need to be re-calculated for every block, but would it make cryptanalysis easier?
It would make cryptanalysis trivial.
If ...
- 139k
9
votes
Why isn't CTR mode (counter mode) used more often?
There are probably quite a few good reasons for this, although I don't expect that a scientific answer can be composed (as you would need to use a survey, and I've never heard of such a thing for ...
- 89.3k
9
votes
How to Implement Deterministic Encryption Safely in .NET
You can safely use HMAC-SHA256 instead of the SIV mode custom PRF to derive the nonce/authentication tag. There's some caveats:
HMAC-SHA256 gives a 256-bit output; you'll have to truncate it to the ...
8
votes
Accepted
Implementing 5 modes of operation with a hash function
The modes you are referencing are specifically modes of operations for block ciphers, and therefore are not directly applicable to hash functions. Block cipher operations take 2 inputs, the key and a ...
- 12.9k
8
votes
Accepted
Using checksum instead of hash for authenticating ciphers
If we were to use CTR, what would you think of using a checksum on
plain text then encrypt whole.
That's a really bad idea (from a security perspective).
Here are the reasons for this:
Depending ...
- 45.3k
8
votes
What are the risks of using CTR mode with 64 bit blocks?
This answer summarizes what's achieved against CTR mode in the paper pointed by Yehuda Lindell's answer: Gaëtan Leurent and Ferdinand Sibleyras's The Missing Difference Problem, and its Applications ...
- 132k
8
votes
Accepted
AES-128/CTR/NoPadding HMAC vs Signature
Yes, there is an important one; The Non-Repudiation;
Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated ...
- 45.7k
7
votes
Accepted
Are all stream-ciphers IND-CPA?
No.
There is a difference between the type of a cipher and the construction of a cipher. If a cipher is of a specific type for which there are known IND-CPA secure constructions then that doesn't ...
- 89.3k
7
votes
Does CTR mode yield a PRF?
It is not accurate to say that the keystream from AES-CTR is a pseudorandom function. However, it is a pseudorandom generator. Furthermore, the construction that you gave is close to working but it's ...
- 27.3k
7
votes
AES decryption vs encryption speed
Given the choice, it is preferable to use the block encryption operation of AES, since it often faster than block decryption (never slower AFAIK). For this reason, AES-CTR is defined to use the block ...
- 132k
7
votes
How is decryption done in AES CTR mode?
A slight correction about terminology:
The key is constant when you use CTR.
The IV/counter affect the cipher input and so the keystream varies.
The reason this can be decrypted is that the ...
- 31.8k
7
votes
Accepted
CPA-security of CTR mode
One gap in your proposed argument is that $ctr$ is known to the adversary (it is included in the ciphertext), whereas saying "$G_k(ctr)$ is pseudorandom" implicitly assumes that both $k$ and $ctr$ are ...
- 5,692
7
votes
Accepted
Can I create a random access CSPRNG from a hash?
There is a name for "random access PRG" : it's called a pseudorandom function (PRF). Any block cipher is a pseudorandom function (that's more-or-less the definition of what it means to be a secure ...
- 11.2k
7
votes
Accepted
Hashing a counter to prevent distinguishers in CTR mode
I'm reading the question as generating a keystream per: $S_i\gets E_K(F(\mathrm{IV},i))$ where $F$ is a public function built from a hash function; for incremental index $i$ starting from $0$ and ...
- 132k
7
votes
Accepted
Is it safe to reuse the password when using AES-CTR with scrypt?
CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero ...
- 6,239
6
votes
Accepted
Why is it good to split a CTR-mode counter into nonce and counter?
Suppose you do CTR mode as:
$E(k,nonce+1) \oplus m_1$, $E(k,nonce+2) \oplus m_2$, $E(k,nonce+3) \oplus m_3$, etc.
The wikipedia page is talking about a non-random nonce, with a specific example of ...
- 11.2k
6
votes
What does a stream cipher provide that cannot be obtained with AES CTR mode operation?
First, AES-CTR isn't "similar to a stream cipher." It is a stream cipher. That means the real question is "why do we develop new stream ciphers when AES-CTR provides an acceptable one?"
The answer is ...
- 3,567
6
votes
Accepted
Turning a 64 bit block cipher into a 128 bit block cipher
There are two well-known Encryption modes, that can construct a $mn$-bit tweakable blockciphers from a $n$-bit blockcipher ($n=64$ for DES) with $1\le m\le n$.
The older one is CMC, being not ...
- 45.3k
6
votes
Accepted
Using HMAC as a nonce with AES-CTR encrypt-and-MAC
What you're describing is pretty similar to the SIV block cipher mode. It also uses a deterministic function of the message to derive the nonce for CTR encryption. Under some pretty widely accepted ...
- 4,606
6
votes
Accepted
Multi-target attacks on AES-CTR with a random nonce
Some amount of known or controlled plaintext is clearly required for the attacker to get the block cipher output.
Actually, that's not much of an issue; we can often get a reasonable amount of known ...
- 139k
Only top scored, non community-wiki answers of a minimum length are eligible