Modes of operationAcceptable
Counter mode
Block cipher mode that behaves as a stream cipher
How it works
CTR encrypts a nonce combined with an incrementing counter to produce a keystream, then XORs the keystream with the plaintext. No padding is needed and both encryption and decryption can run in parallel. GCM is CTR mode with an authentication tag added.
Status: Secure for confidentiality with unique counters; add a MAC or use GCM for integrity.
Strengths
- Fully parallel and fast
- No padding, so no padding oracle
- Random access to any block
Weaknesses and known attacks
- Reusing a nonce and counter value with the same key reuses keystream, exposing the XOR of plaintexts.
- Malleable: flipping a ciphertext bit flips the same plaintext bit, and nothing detects it without a MAC.
Use it for
- High-throughput encryption combined with a MAC
- As the encryption core of GCM
Don't use it for
- Anything needing integrity without adding authentication
- Designs where counters could repeat (for example after a device reset)
Exam tip
CTR turns a block cipher into a stream cipher. Its two exam weaknesses are counter reuse and lack of integrity.