**Problem:**

I'm slightly worried about counter repeats in CTR mode when using random IV.

 - If you split it on half block size (half IV, half counter), it increases chances of same IV (it is smaller).
 - If you start with full block IV, counters may overlap.


How to get full block IV and half block counter in CTR without overlaps?

**My proposed solution:**

Instead of using random IV as nonce in counter we create new key by encrypting IV with key. We than use that new key for encryption. Counter starts with all zeros (or with half of IV or with half of original key to make [multi-target attacks][1] harder).

Assume that key, IV, block cipher are all same size.

```k = Ek(IV)```

Is this any better/worse? I'm worried this would weaken the key. Different key and IV combination would give same new key.

Is there better solution for this "problem"? Besides bigger block size.


  [1]: https://crypto.stackexchange.com/questions/68774/can-a-zero-nonce-be-safely-used-with-aes-gcm-if-the-key-is-random-and-never-used