In CTR mode, two messages were mistakenly encrypted with the same key and the same nonce. For the byte at one position, the first plaintext P₁ is 01001000 (ASCII "H"), its ciphertext C₁ is 01110100 and the second ciphertext C₂ is 01010101. If the attacker knows P₁, which of the following is the second plaintext P₂ at the same position?

Answer: C. 01101001

With the same key and nonce the keystream K is the same, so C₁ = P₁ ⊕ K and C₂ = P₂ ⊕ K. First K = P₁ ⊕ C₁ = 01001000 ⊕ 01110100 = 00111100 is found, and then P₂ = C₂ ⊕ K = 01010101 ⊕ 00111100 = 01101001 (ASCII "i"). Without knowing the key, knowing one plaintext directly gives the other. For this reason, never using the same nonce twice under the same key is an essential condition in CTR mode and GCM.

• A. 00100001 is C₁ ⊕ C₂, which equals P₁ ⊕ P₂. XORing it further with P₁ gives P₂.
• B. 00111100 is the keystream obtained from P₁ ⊕ C₁. XORing it with C₂ gives P₂.
• C. Correct. C₂ ⊕ (P₁ ⊕ C₁) = 01101001.