# What is encrypted with the key to give the keystream in CTR mode exactly?

I'm learning how CTR mode and there is something I have trouble understanding. If I understood correctly, two components are encrypted with the key, a nonce and a counter concatenated, and it looks like for example a5b1fe9ac36701ba0000000000000003 : 8 bytes of nonce and 8 bytes of the counter padded with zeros. However, I also read that reusing the nonce produce the same keystream and must be avoided. Why is that, since the counter will differ each time ?

• The counter always starts at zero. So it would be the same. Aug 12 '20 at 15:43
• @Maeher It always starts at zero and increments by one for each block, but this small incrementation should change the whole keystream because of the avalanche effect, no ? Aug 12 '20 at 15:49
• Yes, that's the general idea. Aug 12 '20 at 15:59

Beware that it is often up to the user to make sure that the counter doesn't overflow into the nonce. Furthermore, if the nonce is randomized then you should take note of the birthday paradox; it might be a good idea to increase the nonce size compared to the message size. E.g. a 32 bit counter would still leave you with $$16 \cdot 2^{32} = 64\ \text{GiB}$$ message size. That should even be enough for most high bitrate movies, and it would leave you with a full 96 bits for the nonce. The authenticated cipher mode GCM - which uses CTR mode internally - does exactly specify 64 GiB - 32 bytes as maximum message size, so you can guess the nonce and counter size by that alone.