Do some Block Cipher Modes encrypt the nonce and then XOR it with the data?

Reading https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) it looks like CTR (and some other modes) encrypt the nonce (plus count, for CTR) rather than the plaintext.

The plaintext is then XOR'd with the encrypted nonce to produce the ciphertext.

Have I understood this correctly?

Why is it done this way round?

• A further read on CTR mode where you can find the original; definition of the CTR mode on the history part, too. Jun 2 '21 at 19:29

Yes, CTR (resp. OFB) mode first "encrypt the nonce" then increment it (resp. replace it by the result of the block encryption), and repeat, producing a keystream; the plaintext is just XORed with the keystream, forming the ciphertext. In effect, CTR and OFB are stream ciphers made from a block cipher.

• which block decryption in software – Same with hardware. When using AES-NI acceleration, decryption is still slower than encryption and you need to use some additional instructions (AESIMC). Jun 4 '21 at 23:08