Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

Question

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.

Answer 1

To expand on Thomas's answer, you have to transfer a CTR nonce somehow for the simple reason that you should need it to decrypt your data. Specifically, for a given block of data you calculate: $$p = N \oplus c(i)$$

Where $i$ is the count of the blocks you have used, $c$ is the count function which might be very straightforward, $N$ is your nonce and $\oplus$ is some combination operation. Your nonce makes this sequence $p$ unique. Without knowing it, you would not know how to start generating the plaintext that will be encrypted to generate the key stream.

Now, the reason you can distribute this in the clear is that each $p$ will be encrypted with the symmetric algorthim $S$ using key $k$. $k$ is kept secret, making it impossible to generate the keystream $s = S(p, k)$. The whole point of the block cipher $S$ is that you cannot go from the ciphertext to the plaintext without the key and since it is symmetric that should apply the other way around too.

At this point, being able to generate $p$ should be a non-issue because from there you should not be able to generate $s$.

Answer 2

It is an IV and it is safe to transmit with the ciphertext (if it wasn't, we would call it a key).