# Behavior of AES-CTR with 128-bit nonce and possible overflow

If I feed 128 bits of randomness into AES-CTR as its IV / nonce / initial counter, what will happen if I feed in a random 128-bit integer that overflows and wraps around?

I've written a test for this and found that at least some CTR implementations do the expected thing and wrap the entire uint128 around, but is it possible to guarantee this? Are there common implementations that will fail or do different and thus incompatible things here?

I guess what I'm asking is whether this is portable or not.

• We would like to see more about your test results. If I've understood correctly there will no problem till the counter repeats itself. A good library, though, will never let you do this. – kelalaka Mar 26 at 17:05
• AES-CTR would be secure no matter what block input sequence were used, as long as that sequence does not repeat blocks. So incrementing mod $2^{128}$ should be safe even if it wraps back to zero. However questions about programming or about the particulars of software libraries are considered off topic on this website. Questions about specific libraries should go to StackOverflow. More open ended questions about the software ecosystem maybe belongs on SuperUser. – Future Security Mar 29 at 0:02