4 ms·
It's probably as superstitious as your XORophobia but the counting part of CTR has always made be a bit uncomfortable.
by brl 17y ago
It's probably as superstitious as your XORophobia but the counting part of CTR has always made be a bit uncomfortable.
- tptacek 17y agoIt's not superstition; I have at least 1 looping CTR counter finding in the last year. That definitely happens. Idle meta-point: is it just me, or do algorithms that actually encode lengths and counts have a bad track record? MD5, CTR, CCM...
- brl 17y agoYes, I suppose that's a unique implementation risk for CTR and in that case Kragen's concerns about XOR are valid as well since you've got a stream cipher with a short period. I was more thinking about how the cipher input has a predictable structure, in particular every pair of adjacent blocks differ by only a single fixed bit. This isn't an issue unless the underlying block cipher is badly broken, but it still feels unnecessarily risky.
- tptacek 17y agoOFB has the same problem with IV reuse, but because CTR divides the IV into a nonce and a counter, it basically begs you to make the error by giving you two opportunities to make it.