The CTR mode (counter) and stream encryption

CBC is secure, but it requires encrypting the blocks in order: each one waits for the previous one. The CTR mode offers a radically different approach, which turns a block cipher into a stream cipher.

The idea: encrypt a counter

CTR stands for Counter. The trick is to never pass the message through AES. Instead, we encrypt a sequence of counters to produce a stream of pseudo-random bits, which we then combine with the plaintext by a simple XOR.

Pour chaque bloc i :
   nonce || i   --[ AES, clé K ]-->  flot_i
   clair_i  XOR  flot_i          =   chiffré_i

The nonce (number used once) is fixed for the message; the counter i is incremented at each block. So we encrypt nonce||0, nonce||1, nonce||2, etc.

The complete scheme

  nonce||0      nonce||1      nonce||2
     |             |             |
  [AES K]       [AES K]       [AES K]
     |             |             |
   flot_0        flot_1        flot_2
     |             |             |
clair_0 -XOR-  clair_1 -XOR-  clair_2 -XOR-
     |             |             |
 chiffré_0     chiffré_1     chiffré_2

Decryption is identical: we regenerate the same keystream (same key, same nonce, same counters) and redo the XOR. No need for the AES decryption function, nor for padding: the message is processed byte by byte, like a stream.

The advantages

• Parallelizable: each flot_i is computed independently, on as many cores as you like. CBC, by contrast, is sequential.
• Random access: to decrypt block 500, you directly compute flot_500 without going through the previous ones. Ideal for disk encryption.
• No padding: the stream adjusts to the exact size of the message.

The absolute danger: reusing (key, nonce)

Like the one-time pad, CTR relies on a keystream that must never be used twice. If we encrypt two messages with the same (key, nonce) pair, the same keystream is reused, and:

chiffré_A XOR chiffré_B = clair_A XOR clair_B

The keystream cancels out and the attacker obtains the XOR of the two plaintexts — a catastrophic leak, without ever knowing the key. The rule is absolute: never twice the same (key, nonce).

A word about GCM

In practice, we often use GCM (Galois/Counter Mode), which is CTR + authentication. In addition to encrypting, GCM computes a tag that guarantees the message has not been modified. It is an authenticated encryption scheme (AEAD), recommended by default today: it protects both confidentiality and integrity.

In summary

• CTR encrypts a counter (nonce + index) and XORs the result with the plaintext: it is a stream cipher.
• It is parallelizable, offers random access and needs no padding.
• Danger: never reuse the (key, nonce) pair, or you reveal the XOR of the plaintexts.
• GCM = CTR + authentication (AEAD): confidentiality and integrity, the recommended modern choice.