Since AES CTR mode uses a unique IV and counter to produce the key to XOR with the plain text to get the ciphertext, the question is so as to how decryption is done. Since AES CTR produces a different cipher each time for the same password and plain text due to the unique key, how is it possible for the decryption function to produce the same key for a given password to get back the plain text?

Can anyone please explain me on how this is happening?

  • 2
    $\begingroup$ Have you checked wiki page? Which part does not add up? $\endgroup$
    – Makif
    Commented Apr 28, 2016 at 5:33
  • $\begingroup$ When decrypting you use the same key and initial counter value. So the output of the AES used for the XOR is the same both at encryption and decryption. $\endgroup$
    – mandragore
    Commented Apr 28, 2016 at 16:57

1 Answer 1


A slight correction about terminology:

  • The key is constant when you use CTR.
  • The IV/counter affect the cipher input and so the keystream varies.

The reason this can be decrypted is that the decrypter knows both the key and the IV/counter. They can calculate exactly the same function as the encrypter did, resulting in the same keystream block, which a XOR then cancels out.

The images on the wiki page for block cipher modes show how both sides compute the same thing.

  • 1
    $\begingroup$ I would only add the idea that CTR mode is a way to use block cipher as a stream cipher. The only thing to understand is /how/ the keystream is generated. That adds almost nothing to your answer, but maybe could clear out some doubts... $\endgroup$
    – ddddavidee
    Commented Apr 28, 2016 at 7:32
  • $\begingroup$ Addition: AES-CTR encryption and decryption are the same, except for treatment of the IV. Usually, encryption puts the IV (or the part of it that is not conventionally all-zero) at start of ciphertext, and the decryption extracts it and uses it as IV. $\endgroup$
    – fgrieu
    Commented Jan 6, 2021 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.