# Implement AES-CTR on top of AES-ECB

I using a microcontroller which only support AES-ECB encryption i.e. no decryption-mode, CBC, GCM or similar modes.

However, I'm wondering if it's possible to implement AES-CTR or similar on top of AES-ECB?

I'm grateful for help, tips, similar implementations etc.

Cheers

• Don't think of it as "AES-ECB", just think of it as "AES" - the cipher mode is something you have to implement yourself. – user253751 Mar 12 '17 at 0:02
• @immibis Usually you have either AES as the block cipher or in ECB mode. There is a difference: AES can only handle one block at a time while ECB can handle multiple blocks at a time. The latter can be of use for counter mode: just line up multiple counter blocks and encrypt them using a single call. Then you have a large buffered key stream which can be XOR'ed with the plaintext. The single call is likely more efficient than multiple calls. – Maarten Bodewes Mar 12 '17 at 12:35
• @MaartenBodewes Too bad the same thing can't work with CBC mode. – DepressedDaniel Mar 12 '17 at 19:53
• @MaartenBodewes I assume the asker is talking about a CPU instruction or similar - in which case it will only work with a fixed amount of data at a time, presumably a single block. – user253751 Mar 13 '17 at 0:15

Of course you can implement CTR mode if all you have is ECB. All you have to do is use ECB to encrypt the successive counter values and use the resulting ECB-ciphertext as the CTR keystream to xor with the actual plaintext you want to encrypt. So for example, the first few counter values to encrypt with ECB would be (where $N$ is a 64 bit nonce / IV which is then concatenated with a 64 bit counter) $N || 0$, followed by $N || 1$, then $N || 2$ and so on.