Does having a nonce in CTR mode actually improve security (vs. just using 1, 2,

Question

Does having a nonce in CTR mode actually improve security (vs. just using 1, 2, 3, etc. - basically a constant nonce of 0)?

As far as I can tell, the best-case scenario security-wise is that the nonce could act as a sort of second key, which would also be shared securely between the communicating parties. But if the underlying block cipher is secure (let's say AES-128), that should be both unnecessary and unhelpful...right?

It seems to me that specifying a nonce only gives a false sense of added security. Am I missing something?

Explanation / Answer

The "nonce" is better known as the Initialization Vector -- with "IV" being the universal short name for that concept. CTR mode works by encrypting the successive values of a counter (CTR stands for "CounTeR"), so the IV in CTR mode is merely the value at which the counter starts.

CTR basically produces a long key-dependent pseudorandom stream, and encryption occurs by XORing that stream with the data to encrypt; in that sense, it is very similar to One-Time Pad, except that the key stream is generated with AES (as a kind of PRNG): this voids the mathematical greatness of OTP, i.e. its absolute security, but it makes the scheme usuable in practice.

Using an IV of value zero is fine... as long as you do it only once. If you reuse a counter value (with the same key) for another run, then you end up with the same thing as OTP where the "pad" is not "one-time". This is a classical break. The idea is that, for a given key, you should consider each counter value as "burnt" whenever you use it. If you do a first encryption run starting with counter value 0, then you will use counter values 0 to, say, 12782 (for instance if the data encrypted that time had length 276525 bytes). If you do not change the key, then you MUST NOT reuse any of the counter values 0 to 12782. The next encryption run with that key ought to start with IV = 12783.

Conversely, sticking to an IV of value 0, always, will be secure as long as you use the AES key only once. This would make sense in an SSL-like protocol, where a connection-specific encryption key is negotiated during an initial handshake, used for that connection, then dropped forever.

Related Questions

Navigate

• Browse (All)
• Browse D
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.