If – when using AES in CTR mode – you decide to use the setup where you combine the IV and the block count value into a single value, as suggested here, the first 12 bytes are your IV and the last 4 bytes the block counter value. But what exactly do you do with block count value in terms of storage and subsequent decryption?
I’ve looked at a number of questions at Crypto.SE and other sources but I can’t seem to find an explicit explanation of this. I’m at a very elementary level of understanding of AES, so maybe some things I’ve read assumed some level of reader knowledge, or it’s figured the answer should be obvious to most.
According to NIST SP800-38A, §6.5, if we let our 12 byte IV be $INPUT\ BLOCK$ in the diagram and our 4 byte block count value be $COUNTER$, the 16 byte IV/block count is incremented by $1$ up to $n$; the number of plaintext blocks you have.
When you are done encrypting and are ready to store the data, do you subtract $n$ from the 16 byte IV/block count (equivalently just storing the 12 byte IV with the ciphertext) or would you store the entire 16 byte IV/block count (not resetting the counter)?
I guess my confusion stems from the fact that – when using CTR mode – the counter just reset to 0 and because decryption with CTR is the same as encryption, decryption starts with the 16 IV/block count? Are all the bits in the 4 byte block count are set to zero since you’re starting over, or does the counter start at $n$?