AES CTR with similar IVs and same key Let's say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs.

So for example,  a 16 byte IV, the 2nd 8 bytes are always the same, but the 1st 8 bytes are random. 

How insecure is this?

I know that you shouldn't use the same IV and key. But do similar IVs have the same vulnerability or a different way to attack them?
As the name suggests, CTR mode works by encrypting a counter (that gets incremented with each 16-byte block) to generate a stream of random bits. That bit stream is then XOR'ed with the plaintext to create the ciphertext. The IV provides the initial value for the counter.

CTR mode is secure as long as the probability of a counter value repeating is negligible. Therefore the scheme you describe is secure under two conditions:


No message is longer $2^{32}$ sixteen-byte blocks long. Since this works out to be 64GB, this assumption is probably safe. (I'm assuming the 32 IV bits that are the same each time are the bits that get incremented with each block.)
The number of messages encrypted under a single key is small.


How small is small? Well, the birthday paradox says that if you encrypt $2^m$ messages, the probability that the random, 64-bit portion of the IV will repeat is at most $2^{2m}/2^{64}$. So if you encrypted $2^{16} = 65536$ messages, the probability of having a repeated counter is less than one in $2^{32}$; i.e., less than one in roughly four billion. In most cases, this is an acceptable risk (although some may consider it high by cryptographic standards).