How does CTR-ESSIV work?

Question

I'm using Wikipedia and Handbook of Applied Cryptography as references. I know that ESSIV generates an initialization vector (IV) by combining a hashed key with the sector number.

However, I only see an IV in CBC, PCBC, CFB, and OFB modes of operation e.g. chained modes. CTR and ECB are not chained modes, so where does the IV go?

Comparing two files encrypted with CTR-ESSIV versus ctr-plain with a plain unsalted key, the entire stream is different, not just the first block. This means the IV is applied to all blocks in CTR mode. However, when doing the same with ECB mode, the two files are identical. This means the IV is not used in ECB mode at all.

So, where and how exactly is the IV applied in CTR mode?

Answer 1

For key $k_0$, nonce $n$ (‘initialization vector’), and message $m = m_0 \mathbin\| m_1 \mathbin\| \cdots \mathbin\| m_{\ell - 1}$, the AES-CTR ciphertext is $c = c_0 \mathbin\| c_1 \mathbin\| \cdots \mathbin\| c_{\ell - 1}$ where $$c_i = m_i \oplus \operatorname{AES}_{k_0}(n \mathbin\| i),$$ where $n \mathbin\| i$ is some unique encoding of $n$ and $i$ as a 128-bit block. ESSIV means we derive $$n = H_{k_1}(\mathit{sector\ number})$$ to encrypt each disk sector. We usually call $n$ a nonce instead of an IV because the only rule is that it must never be repeated with the same key; the consequences of nonce reuse are catastrophic.

This means that ‘CTR-ESSIV’ not terribly useful for disk encryption unless you never rewrite a disk sector: the standard threat model for disk encryption is disclosure of multiple versions of a disk, which would be the case if the border police confiscate your laptop whose SSD had queued up old versions of many disk sectors for deferred erasure. In this threat model, CBC-ESSIV leaks only how long a prefix of each sector changed between the two versions; in contrast, CTR-ESSIV may allow arbitrary decryption of disk sectors depending on what the adversary knows about the different versions.