I use AES-CTR to perform on the fly encryption of packets. Each packet is 16 bytes long, however, depending on what is being transferred, the 16 bytes may not be used. So far, unused bytes are left to 0.

I'm not a cryptographer, but I'm wondering how helpful this can be to an attacker to have such an information. Knowing the protocol, you can guess a few bytes per packet in general, but with these bytes left to 0, you can actually guess most bytes.

Would it be recommended to instead use random padding instead of zeroes ?


What you are describing is somewhere in between a so called "known plaintext attack" and a "ciphertext only attack".

While these were (and sometimes still can be) a problem for older cryptosystems and modes of operation, in the recent history of cryptography cryptosystems and modes of operation are usually specifically designed to be resistant to such attacks.

There is currently no known attack (citation obviously not given) against AES-CTR in which (partially) knowing the plaintext results in a non-negligable advance for an attacker.

TLDR or TCDNU: Iff you use AES-CTR correctly, this should not be a concern. However, you might want to consider using AES-RCTR or AES-GCM. Especially the latter has many advantages, two of which being readily available implementations and being tamper-proof.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.