Problem - Kevin Tafuro

The primary disadvantages of CTR mode are:
• Flipping bits in the plaintext is very easy because flipping a ciphertext bit flips
the corresponding plaintext bit (this problem is shared with all stream cipher
modes). As with other encryption algorithms, message integrity checks are absolutely
necessary for adequate security.
• Reusing {key, counter} pairs is disastrous. Generally, if there is any significant
risk of reusing a {key, nonce} pair (e.g., across reboot), it is best to avoid ever
reusing a single key across multiple messages (or data streams). (See Recipe 4.11
for advice if you wish to use one base secret and derive multiple secrets from it.)
• CTR mode has inadequate security when using ciphers with 64-bit blocks,
unless you use a large random nonce and a small counter, which drastically limits
the number of messages that can be sent. For this reason, OCB is probably
still preferable for such ciphers, but CTR is clearly better for 128-bit block
ciphers.
The primary advantages of CTR mode are:
• The keystream can be precomputed.
• The keystream computation can be done in parallel.
• Random access into the keystream is possible. (The 1,024th byte can be
decrypted with only a single raw encryption operation.)
• For ciphers where raw encryption and decryption require separate algorithms
(particularly AES), only a single algorithm is necessary. In such a case, the faster
of the two algorithms can be used (though you will get incompatible results if
you use decryption where someone else uses encryption).
• CTR mode leaks incredibly little information about the key. After 264 encryptions,
an attacker would learn about a bit’s worth of information on a 128-bit
key.
CTR mode is old and simple, and its security properties are well understood. It has
recently gained a lot of favor in the cryptographic community over other solutions
for using block ciphers in streaming modes, particularly as the world moves to AES
with its 128-bit blocks.
Many of the “better” modes that provide built-in integrity checking, such as CWC
and CCM mode, use CTR mode as a component because of its desirable properties.
We discuss CTR mode in Recipe 5.9.
Output Feedback (OFB) mode
OFB mode is another streaming mode, much like CTR mode. The keystream is generated
by continually encrypting the last block of keystream to produce the next
block. The first block of keystream is generated by encrypting a nonce. OFB mode
166 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.