Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Edit: I'll put up this more clearly.

By the most simplest form, I'm asking that if I AES encrypt in CTR more with Mcrypt (using PHP), can I create the "IV" by just simply reading 16 bytes from /dev/urandom? Does that do the job properly?

I read the previous answer by D.W. and he said:

"In the simplest form, to encrypt a n-block message under the IV v, we use v, v+1, v+2, .., v+n-1 as the counters, so let me assume that's what you are doing (if not, please specify). Generating a random 128-bit counter using /dev/urandom is fine."

Now I'm asking that did I understand that answer right (my understanding is that if using CTR mode, one can create the "IV" by just reading from /dev/urandom and that about it)?

I split up this question from TCrypto - Comments about design decisions I made?

@D.W. *"It depends which variant of CTR mode you use, and how the counter is formed. In the simplest form, to encrypt a n-block message under the IV v, we use v, v+1, v+2, .., v+n-1 as the counters, so let me assume that's what you are doing (if not, please specify). Generating a random 128-bit counter using /dev/urandom is fine."*

I was looking at this and I'm not sure if Mcrypt already does that "v+1, v+2..." nonce construction internally (using the supplied IV). Basically Mcrypt takes a key and an IV and performs the encrytption using those parameters.

Or do I have to manually split the message into chunks and perform the encryption for the first chunk using the IV, then encrypt the second chunk using IV+1 as the IV etc?

Here is the encryption function (in CBC mode, Mcrypt's interface to use CTR mode is similar):

https://github.com/timoh6/TCrypto/blob/master/library/TCrypto/CryptoHandler/McryptAes256Cbc.php#LC31

share|improve this question
    
I'm lost. Can you ask the question in a self-contained way, providing all details that are needed to answer the question here? What are you trying to accomplish? What are your constraints? Are you looking for review of an existing scheme? Are you looking for us to design a scheme for you? etc. You may need to spend some time thinking about how to frame your question, how to present all the relevant background information, etc. –  D.W. Jul 11 '11 at 0:22
add comment

1 Answer 1

Your question is very confusing. It does look like mcrypt_create_iv will use /dev/urandom if you call it with MCRYPT_DEV_URANDO. It also looks like you do not need to specify the counter value and you only need to call mcrypt_generic once.

share|improve this answer
    
I have had the same feelings about this. I was actually asking this just to make sure that I'm right about it. In other words, do you think it is safe to use CTR mode and provide the "IV" using data from /dev/urandom? –  timoh Jul 26 '11 at 7:47
    
In security I never feel comfortable saying safe. I would say it seems reasonable for protection of low to medium value assets, assuming the rest of your system is appropriatly protected. –  this.josh Jul 26 '11 at 8:12
    
Right. At least for now, I'll stick with "CBC with random IV". It has some disadvantages, but in general, it is a safe go. –  timoh Jul 27 '11 at 9:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.