I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the value is not always the IV? It seems to be totally random which value is added to the IV. Maybe someone of you can tell me why this IV is not used as the counter but some value is added to it. When I know the value added to the IV the decryption works without problems (but I would like to do this without testing for the value).
I am tracing the OpenSSH/OpenSSH-portable implementation. And for decrypting I use pycryptodome.