4
$\begingroup$

after reading a lot of stuff about AES CTR and its IV i'm still not sure if it is ok to use a predictable IV or not.

I searched the web and found some programs / devices that use encryption in this way.

For example Lora. Lora is a low speed Network for exchanging data (temperatures or humidity sensors ) over a complete cities with thousands of devices.

Example: I've found source code of the Lora Mac on the Web which is doing exactly that.

A Sequence counter that uses every value only once over the entire Node lifetime.

And a little 1 Byte counter for every new 16 Byte Block.

The IV is Initialized by

static uint8_t aBlock[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; after this aBlock[5] = dir; ( direction of message) aBlock[6] = ( address ) & 0xFF; (Hardware address of device) aBlock[7] = ( address >> 8 ) & 0xFF; (Hardware address of device) aBlock[8] = ( address >> 16 ) & 0xFF; (Hardware address of device) aBlock[9] = ( address >> 24 ) & 0xFF; (Hardware address of device) aBlock[10] = ( sequenceCounter ) & 0xFF; (counter that never repeats) aBlock[11] = ( sequenceCounter >> 8 ) & 0xFF; (counter that never repeats) aBlock[12] = ( sequenceCounter >> 16 ) & 0xFF; (counter that never repeats) aBlock[13] = ( sequenceCounter >> 24 ) & 0xFF; (counter that never repeats) aBlock[15] = ( ( ctr ) & 0xFF ); ( a counter value that is incremented for every 16 Byte Block)

Is this secure enough?

Source Code: https://github.com/Lora-net/LoRaMac-node/blob/master/src/mac/LoRaMacCrypto.c Line 108: void LoRaMacPayloadEncrypt()

http://www.semtech.com/wireless-rf/internet-of-things/

Improve this question
$\endgroup$
1
  • $\begingroup$ Don't forget to accept an answer once your question has been answered sufficiently (at this point of time the choice is rather limited but you did get an answer from Yehuda :) ) $\endgroup$ Commented Jan 20, 2017 at 10:29

1 Answer 1

Reset to default
5
$\begingroup$

For CTR mode, a random IV is not needed. The only requirement be that the counter be unique in each block over all encryptions. (This is in contrast to CBC mode where unpredictability of the IV is essential.)

Improve this answer
$\endgroup$
2
  • $\begingroup$ it would be perfectly safe to start an iv at 0? (as long as it is unique) $\endgroup$ Commented Jan 17, 2017 at 15:14
  • 1
    $\begingroup$ Yes that is true. So, if you are in a session setting with a new key, then you can always start at 0. Having said this, if this turns out to be a multi key setting where many different parties are using many keys in different sessions, then there are advantages to using a random IV. $\endgroup$ Commented Jan 17, 2017 at 16:24

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.