Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sigh. Colin, I brought it up for a reason: because we've found it before. I'm not going into more detail†. Take my word for it that this is something you need to be aware of if you're using CTR mode.

I just can't fathom the logic behind blowing off a potential crypto flaw that clearly can occur. What, to you, is the downside of letting people know that CTR can blow up in this manner?

† But, a hint, it has obviously never depended on us sending 295147905179 gigabytes to a target



a potential crypto flaw that clearly can occur

Well, that's the thing. I can't see how CTR counter wraps can occur. 64-bit counters which start at zero simply don't wrap.


I suppose the point is that not everyone in your audience will be using 64-bit counters.


We're getting near 20 questions territory here. I think I've made my point.


Well, would you mind humoring us? The unwashed masses...


Just make sure your counters can't wrap and you don't have this problem, noting that attackers will do things to try to force your counters to wrap.


If you're talking about starting the AES-CTR counter at 2^64-x, that's a buggy AES-CTR implementation: AES-CTR counters always start at zero.


Jiminy. This is like saying "if you're talking about a CTR implementation tht forgets to make nonces unique, that's a buggy CTR implementation". Well, no shit, Colin.

This case has the added benefit of you being wrong (the counterspace always starts at zero, but that doesn't mean decryption or encryption does).

And: that's not all I'm talking about.


This is like saying "if you're talking about a CTR implementation tht forgets to make nonces unique, that's a buggy CTR implementation"

No, it isn't. The CTR counter is part of the implementation; the nonce is part of how CTR is used by the application.

(the counterspace always starts at zero, but that doesn't mean decryption or encryption does

If you're not encrypting starting from a counter of zero, you're not using a stream cipher. (Most likely, you're using a block storage cipher.)

And: that's not all I'm talking about.

Ok. I was just guessing, because you're claiming that an impossible bug exists and refusing to give any details.


You're drawing irrelevant distinctions here. If it was the case that you'd have to code your own entire implementation of the CTR mode of operation to have these bugs, I'd see your point.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: