Take the 2-minute tour ×

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.

share|improve this question

2 Answers 2

up vote 8 down vote accepted

To expand on Thomas's answer, you have to transfer a CTR nonce somehow for the simple reason that you should need it to decrypt your data. Specifically, for a given block of data you calculate: $$p = N \oplus c(i)$$

Where $i$ is the count of the blocks you have used, $c$ is the count function which might be very straightforward, $N$ is your nonce and $\oplus$ is some combination operation. Your nonce makes this sequence $p$ unique. Without knowing it, you would not know how to start generating the plaintext that will be encrypted to generate the key stream.

Now, the reason you can distribute this in the clear is that each $p$ will be encrypted with the symmetric algorthim $S$ using key $k$. $k$ is kept secret, making it impossible to generate the keystream $s = S(p, k)$. The whole point of the block cipher $S$ is that you cannot go from the ciphertext to the plaintext without the key and since it is symmetric that should apply the other way around too.

At this point, being able to generate $p$ should be a non-issue because from there you should not be able to generate $s$.

share|improve this answer
One could generate the nonce together with the key from some password and salt (or from a key exchange algorithm's shared secret), and then not transfer it explicitely. –  Paŭlo Ebermann Dec 10 '11 at 13:56

It is an IV and it is safe to transmit with the ciphertext (if it wasn't, we would call it a key).

share|improve this answer

Your Answer


