Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's probably as superstitious as your XORophobia but the counting part of CTR has always made be a bit uncomfortable.


It's not superstition; I have at least 1 looping CTR counter finding in the last year. That definitely happens.

Idle meta-point: is it just me, or do algorithms that actually encode lengths and counts have a bad track record? MD5, CTR, CCM...


Yes, I suppose that's a unique implementation risk for CTR and in that case Kragen's concerns about XOR are valid as well since you've got a stream cipher with a short period.

I was more thinking about how the cipher input has a predictable structure, in particular every pair of adjacent blocks differ by only a single fixed bit. This isn't an issue unless the underlying block cipher is badly broken, but it still feels unnecessarily risky.


OFB has the same problem with IV reuse, but because CTR divides the IV into a nonce and a counter, it basically begs you to make the error by giving you two opportunities to make it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: