# how to compute IV with AES CTR if key, plaintext and ciphertext are known?

Given $$E_k$$, which a block-cipher using the (known) key $$k$$, and a plaintext-ciphertext pair $$(p,c)$$ where $$c$$ is the encryption of $$p$$ using CTR mode, can the initialization vector be recovered using $$IV = E_k^{-1}(c \oplus p)$$?

• I generally appreciate improved typography, but the original question provided additional context about what the author's notion of CTR mode is and how the IV figures into the definition, and the answer below was written to match the author's original choice of notation. – Squeamish Ossifrage Feb 23 '19 at 18:55