Problem - Kevin Tafuro

encrypting a plaintext block that includes a counter value. Given a single key, the
counter value must be unique for every encryption.
This mode has many benefits over the “standard” modes (e.g., ECB, CBC, CFB, and
OFB). However, we recommend a higher-level mode, one that provides stronger
security guarantees (i.e., message integrity detection), such as CWC or CCM modes.
Most high-level modes use CTR mode as a component.
In Recipe 5.4, we discuss the advantages and drawbacks of CTR mode and compare
it to other popular modes.
Like most other modes, CTR mode requires a nonce (often called an IV in this context).
Most modes use the nonce as an input to encryption, and thus require something
the same size as the algorithm’s block length. With CTR mode, the input to
encryption is generally the concatenation of the nonce and a counter. The counter is
usually at least 32 bits, depending on the maximum amount of data you might want
to encrypt with a single {key, nonce} pair. We recommend using a good random
value for the nonce.
In the following sections we present a reasonably optimized implementation of CTR
mode that builds upon the raw block cipher interface presented in Recipe 5.5. It also
requires the spc_memset( ) function from Recipe 13.2. By default, we use a 6-byte
counter, which leaves room for a nonce of SPC_BLOCK_SZ - 6 bytes. With AES and
other ciphers with 128-bit blocks, this is sufficient space.
CTR mode with 64-bit blocks is highly susceptible to birthday attacks
unless you use a large random portion to the nonce, which limits the
message you can send with a given key. In short, don’t use CTR mode
with 64-bit block ciphers.
The high-level API
This implementation has two APIs. The first is a high-level API, which takes a message
as input and returns a dynamically allocated result.
unsigned char *spc_ctr_encrypt(unsigned char *key, size_t kl, unsigned char *nonce,
unsigned char *in, size_t il);
unsigned char *spc_ctr_decrypt(unsigned char *key, size_t kl, unsigned char *nonce,
unsigned char *in, size_t il)
Both of the previous functions output the same number of bytes as were input,
unless a memory allocation error occurs, in which case 0 is returned. The decryption
routine is exactly the same as the encryption routine, and it is implemented by
macro.
198 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.