4 ms·
I'm with you on CTR mode: it's a uniquely dangerous recommendation to anyone who needs to be soliciting recommendations in the first place. If you're encryptin
by dfranke 17y ago
I'm with you on CTR mode: it's a uniquely dangerous recommendation to anyone who needs to be soliciting recommendations in the first place. If you're encrypting a file, then the obvious, elegant thing to do is to use position in the file as your counter. But then the moment you encrypt two files using the same key, you're screwed: you've just committed the equivalent of reusing a one-time pad. I feel like ever mentioning CTR mode to a novice without bringing this up is like inviting a guest into your house and forgetting to mention that you've rigged the door handle to explode if you turn it in the wrong direction.
- tptacek 17y agoI'm actually not anti-CTR mode; my recommendation (use EAX mode) has basically the same problem --- EAX is just CTR + OMAC. You're right that stream ciphers blow up more spectacularly than block encryption does. You have to be sure not to re-use anything (counters, nonces, keys, etc). If "don't overfill a buffer" is an easy prescription that cost industry $4+bn USD, it's hard to imagine how unlikely it is people can avoid screwing up "don't reuse anything". On the other hand, differentiatable errors cause spectacular problems with block encryption. See: the "bad padding" error message that decrypts entire AES blocks a byte at a time.