4 ms·
Well, would you mind humoring us? The unwashed masses...
by swaits 16y ago
Well, would you mind humoring us? The unwashed masses...
- tptacek 16y agoJust make sure your counters can't wrap and you don't have this problem, noting that attackers will do things to try to force your counters to wrap.
- cperciva 16y agoIf you're talking about starting the AES-CTR counter at 2^64-x, that's a buggy AES-CTR implementation: AES-CTR counters always start at zero.
- tptacek 16y agoJiminy. This is like saying "if you're talking about a CTR implementation tht forgets to make nonces unique, that's a buggy CTR implementation". Well, no shit, Colin. This case has the added benefit of you being wrong (the counterspace always starts at zero, but that doesn't mean decryption or encryption does). And: that's not all I'm talking about.
- cperciva 16y agoThis is like saying "if you're talking about a CTR implementation tht forgets to make nonces unique, that's a buggy CTR implementation" No, it isn't. The CTR counter is part of the implementation; the nonce is part of how CTR is used by the application. (the counterspace always starts at zero, but that doesn't mean decryption or encryption does If you're not encrypting starting from a counter of zero, you're not using a stream cipher. (Most likely, you're using a block storage cipher.) And: that's not all I'm talking about. Ok. I was just guessing, because you're claiming that an impossible bug exists and refusing to give any details.
- tptacek 16y agoYou're drawing irrelevant distinctions here. If it was the case that you'd have to code your own entire implementation of the CTR mode of operation to have these bugs, I'd see your point.