3 ms·

I SAW THAT TPTACEK SAYS CTR MODE IS NOT A SCARY CONSTRUCTION! Oh you are never going to live that down brother :-)

• tptacek 13y ago
  IN A RANDOM NUMBER GENERATOR. I am not terrified of CTR, by the way; I just think CBC gets a bad rap. It's interesting that people can be on a jihad against DSA for needlessly depending on randomness, but not at all perturbed by the CTR randomness failure mode. (Granted, the DSA failure mode is much worse and much harder to get right.)
  • marshray 13y ago
    And why is it OK for use in a PRNG/DRBG and not a cipher?
    • fleitz 13y ago
      Because generally the plaintext input to a PRNG using a cipher in CTR mode is uninteresting to attackers, and generally cannot be controlled. What a DRBG needs to do is provide unpredictable bits, not bits that can't be decrypted.
      • marshray 13y ago
        If the "plaintext input to a PRNG" becomes known to the attacker, the entire output of the PRNG becomes known (i.e., 'predictable') to the attacker.
        • fleitz 13y ago
          That's why I try not to give attackers root access to the system, that way they can't examine the state of my PRNG.
    • tptacek 13y ago
      Because PRNG constructions tend to run the whole key schedule when they refresh their state; for instance, CTR_DRBG uses inputs to derive a nonce and a whole new key.
  • marshray 13y ago
    BTW, I think that's a great point about the comparison with DSA.
    • tptacek 13y ago
      I'm obnoxious, but every once in awhile I get a good one in. :)