Quiz Entry - updated: 2026.10.26
Why can't OFB and CTR modes use the same (Key, IV) pair for different messages?
Because they would generate the identical keystream, and XOR-ing two ciphertexts would cancel the keystream and reveal the XOR of the two plaintexts — the same two-time pad attack as with stream ciphers.
The attack:
$$\begin{aligned} C_1 &= M_1 \oplus S && \text{(}S\text{ = keystream from }(K, IV)\text{)} \\ C_2 &= M_2 \oplus S && \text{(same keystream!)} \\ C_1 \oplus C_2 &= M_1 \oplus M_2 \end{aligned}$$
This is exactly the OTP reuse problem. Once an attacker has $M_1 \oplus M_2$, crib dragging can recover both plaintexts.
Prevention:
- OFB: Use a new random IV for each message
- CTR: Use a new nonce for each message (the counter part increments within a message, but the nonce must be unique across messages)
- In practice, use a 96-bit random nonce + 32-bit counter (as in AES-GCM)
Tip: Any mode that acts as a stream cipher (OFB, CTR) inherits the stream cipher's fatal weakness: keystream reuse = total break.