Hi All,
I am solving a question about counter mode encryption in symmetric crypto. I am new to the topic and don't really understand the matter, could you help me a little how to solve the following task?

The formula for counter mode encryption is
 Ci = Pi ⊕ E (IV + i, K).
Suppose we instead use the formula
 Ci = Pi ⊕ E (K, IV + i).
Is this secure? If not, what's the possible attack?


If you know one block of plaintext (which in many situations is a reasonable assumption), you can break the second cryptosystem but not the first one (assuming your cipher is secure!). I'll let you figure out how.

You can extend this attack to the case in which one block of plaintext has small entropy, which is an even more realistic assumption.

| cite | improve this answer | |
  • $\begingroup$ Ok, thank you, so we can break the second formula - which attack can we use in such case? $\endgroup$ – Tatiana Apr 5 '17 at 4:04
  • $\begingroup$ Known plaintext attack. $\endgroup$ – Yuval Filmus Apr 5 '17 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.