Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [ctr]

Counter Mode (CTR) is an encryption mode, that builds a random-access stream-cipher from a block-cipher.

Counter Mode (CTR), also known as Segmented Integer Counter (SIC) or Integer Counter Mode (ICM), makes a block-cipher into a random-access stream cipher by generating a keystream using the block-cipher that is XORed with the plaintext to produce the ciphertext. CTR mode generates keystream blocks by encrypting successive values of a non-repeating counter with the block-cipher.

See the wikipedia page for more information.

250 questions
46
votes
2 answers

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
mary
  • 1,011
  • 3
  • 11
  • 13
24
votes
1 answer

(Why) should I avoid using a randomized IV for CTR mode?

I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to the difficulty of generating nonces for CTR: In…
Jeremy
  • 1
  • 1
  • 7
  • 22
23
votes
2 answers

Why do we use XTS over CTR for disk encryption?

I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption. It seems that CTR mode would do exactly what XTS can do, but is simpler to implement? In either mode, I will use the disk sector…
shrek
  • 333
  • 2
  • 5
20
votes
1 answer

Why must IV/key-pairs not be reused in CTR mode?

Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation so far as to why this is the case. The issue is…
Dexter
  • 627
  • 1
  • 6
  • 10
18
votes
4 answers

Is SHA-256 secure as a CTR block cipher?

Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x. We represent numbers in simple binary instead of a counting function. 0 in dec = [256 zeros] in binary, 1 = [255 zeros]1, 23092348 = [241…
Jordan
  • 565
  • 1
  • 4
  • 9
17
votes
1 answer

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field arithmetic ("GHASH") - and the latter seems to be difficult to get right in software…
oberstet
  • 437
  • 1
  • 5
  • 11
14
votes
2 answers

What are the risks of using CTR mode with 64 bit blocks?

On DJB's blog he writes: I was one of about 40 people sitting in a meeting where the speaker, NSA's Louis Wingers (one of the Simon and Speck authors), falsely claimed that counter mode is safe for 64-bit blocks, since counter mode doesn't have…
Future Security
  • 3,223
  • 1
  • 7
  • 26
14
votes
1 answer

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several times dangerous in AES-CBC mode? Does the use of a…
user2398029
  • 523
  • 3
  • 14
12
votes
4 answers

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested, which were ECB, CTR, CBC, OFB, CFB written in…
hanshenrik
  • 477
  • 3
  • 15
12
votes
1 answer

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately the master key will be unique¹. My original plan…
CodesInChaos
  • 24,583
  • 2
  • 87
  • 127
11
votes
3 answers

AES CTR with similar IVs and same key

Let's say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs. So for example, a 16 byte IV, the 2nd 8 bytes are always the same, but the 1st 8 bytes are random. How…
bwbrowning
  • 243
  • 4
  • 7
10
votes
1 answer

Why doesn't CTR mode require blocking?

I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of things. As I understand it, CTR does the…
Louis Thibault
  • 211
  • 2
  • 5
9
votes
2 answers

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently the ChaCha20 as part of the ChaCha20-Poly1305 AE…
user220201
  • 841
  • 1
  • 9
  • 14
8
votes
1 answer

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the question another way, can I encrypt using GCM and…
Tricky Dixon
  • 83
  • 1
  • 3
8
votes
5 answers

AES decryption vs encryption speed

Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?
Dingo13
  • 2,797
  • 2
  • 22
  • 43
1
2 3
…
16 17