Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just the “key”, “IV” (nonce), and “counter start value”?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
As you specified in the question, the key, nonce, and initial counter value are what is required in addition to the ciphertext and algorithm used.
However, it is best practice to have the initial counter always be 0. Common standards place no specific restrictions on the size of the nonce unless it is used in an authenticated encryption mode, but it is generally 96-bits, leaving 32-bits for the counter. A 32-bit counter allows 64 GiB of data to be encrypted per nonce using a 128-bit block cipher. A 32-bit 0-start counter is also more simple for software implementations. If you expect to send more than 64 GiB in a single message, you will need to reevaluate the counter size.
If you plan on having both the clients encrypt data with the same key, care must be taken so that there is no nonce overlap. 2 ways of doing this are prenegotiating a client to only use even or odd nonces, or having one of the clients use only nonces with the high bit set to 1.