# How does CTR-ESSIV work?

I'm using Wikipedia and Handbook of Applied Cryptography as references. I know that ESSIV generates an initialization vector (IV) by combining a hashed key with the sector number.

However, I only see an IV in CBC, PCBC, CFB, and OFB modes of operation e.g. chained modes. CTR and ECB are not chained modes, so where does the IV go?

Comparing two files encrypted with CTR-ESSIV versus ctr-plain with a plain unsalted key, the entire stream is different, not just the first block. This means the IV is applied to all blocks in CTR mode. However, when doing the same with ECB mode, the two files are identical. This means the IV is not used in ECB mode at all.

So, where and how exactly is the IV applied in CTR mode?

• – user991
Feb 8, 2015 at 23:53

For key $$k_0$$, nonce $$n$$ (‘initialization vector’), and message $$m = m_0 \mathbin\| m_1 \mathbin\| \cdots \mathbin\| m_{\ell - 1}$$, the AES-CTR ciphertext is $$c = c_0 \mathbin\| c_1 \mathbin\| \cdots \mathbin\| c_{\ell - 1}$$ where $$c_i = m_i \oplus \operatorname{AES}_{k_0}(n \mathbin\| i),$$ where $$n \mathbin\| i$$ is some unique encoding of $$n$$ and $$i$$ as a 128-bit block. ESSIV means we derive $$n = H_{k_1}(\mathit{sector\ number})$$ to encrypt each disk sector. We usually call $$n$$ a nonce instead of an IV because the only rule is that it must never be repeated with the same key; the consequences of nonce reuse are catastrophic.