I am working on Intel AES-NI library and since the AES function is coded using low-level assembly instructions. I could not see how the IV or initial counter increases in CTR mode. In general, how does the IV or initial counter increase by itself for each 128-bit block (let's say we use AES_CTR_128)? Does it increase by one or some other value?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
The entire block consists of a $n$ bit nonce and a $128-n$ bit counter. Typically $n=64$. The nonce needs to be large enough so that every message under the key can have a unique one, and the counter needs to be large enough that every message block can have a unique counter value.
Typically, the counter is initialized to 0 and then incremented by 1 for each block. However, this isn't mandatory, I don't think there's any reason for that choice beyond the fact that it's the simplest, clearest way to do it. Any initialization value and incrementing function is valid so long as the choice doesn't cause repeats of the counter for the desired message length. (Even the FIPS validation process allows submissions that implement CTR mode to choose both the initial value and the incrementing function their implementation uses.)