LOGBOOK

HELP

Quiz Entry - updated: 2026.10.26

Why can't OFB and CTR modes use the same (Key, IV) pair for different messages?

Because they would generate the identical keystream, and XOR-ing two ciphertexts would cancel the keystream and reveal the XOR of the two plaintexts — the same two-time pad attack as with stream ciphers.

The attack:

$$\begin{aligned} C_1 &= M_1 \oplus S && \text{(}S\text{ = keystream from }(K, IV)\text{)} \\ C_2 &= M_2 \oplus S && \text{(same keystream!)} \\ C_1 \oplus C_2 &= M_1 \oplus M_2 \end{aligned}$$

This is exactly the OTP reuse problem. Once an attacker has $M_1 \oplus M_2$, crib dragging can recover both plaintexts.

Prevention:

  • OFB: Use a new random IV for each message
  • CTR: Use a new nonce for each message (the counter part increments within a message, but the nonce must be unique across messages)
  • In practice, use a 96-bit random nonce + 32-bit counter (as in AES-GCM)

Tip: Any mode that acts as a stream cipher (OFB, CTR) inherits the stream cipher's fatal weakness: keystream reuse = total break.

From Quiz: KRYPTOG / Symmetric Cryptography | Updated: Oct 26, 2026