Hacker News Reader

Be very careful with random-access CTR.

Could you please point to an explanation why random access CTR decryption is dangerous? Or why it's more or less secure than random access CBC decryption?

Or is random access CTR encryption dangerous? I don't see how, unless you reuse the keystream / make it a two-time pad.

https://www.imperialviolet.org/2014/06/27/streamingencryptio...

Thomas's answer probably has to do with the risks of decrypting a stream and being unable to authenticate it first. (See also: the Cryptographic Doom Principle.)

But it is still safe to do random access AES-CTR if you've already checked the MAC. Random access is not a problem, decrypting before authenticating is a problem.

I think that's why the statement was "be careful with" rather than "don't"

Can you elaborate? (Either by direct explanation or by reference to something explaining the hazard there?)

Reply on news.ycombinator.com