Cryptology Academy · Lesson

CTR Mode & Stream-Cipher Behavior

Use counter mode to turn a block cipher into a keystream generator.

Lesson 3 of 413 steps

CTR Mode & Stream-Cipher Behavior is a free Cryptology Academy lesson on CoddyKit. This is lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Counter (CTR) mode transforms any block cipher into a stream cipher. It is parallelizable, requires no padding, and is the basis for AES-GCM. Let's master it.

CTR Mode Concept

Generate a keystream by encrypting successive counter values: Keystream[i] = AES(K, Nonce || Counter_i) Ciphertext = Plaintext XOR Keystream The counter increments for each block. Decryption is identical to encryption.

CTR vs CBC

CBC: sequential encryption (each block depends on the previous). CTR: fully parallelizable (each block is independent). For a 1 GB file, CTR can use all CPU cores; CBC cannot.

No Padding Required

CTR generates a keystream of any length. XOR with plaintext byte by byte. A 100-byte message uses 100 bytes of keystream — no padding needed. Great for streaming data.

Nonce/Counter Structure

Common split for 128-bit AES block: - 64-bit random nonce (unique per message) - 64-bit counter (increments per block) Or 96-bit nonce + 32-bit counter (GCM standard). Nonce uniqueness is critical — never reuse (nonce, key) pair.

CTR Nonce Reuse Attack

CTR with same (key, nonce) produces the same keystream. Encrypting two different messages: C1 XOR C2 = P1 XOR P2. Just like the many-time pad attack. Catastrophic information leak.

CTR Random Access

CTR allows random access: to decrypt block 1000, compute AES(K, Nonce || 1000) directly. No need to decrypt previous blocks. Ideal for databases and disk encryption (combined with other modes).

CTR in Python

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes import os nonce = os.urandom(16) # Used as counter start cipher = Cipher(algorithms.AES(key), modes.CTR(nonce)) enc = cipher.encryptor() ciphertext = enc.update(plaintext) + enc.finalize()

CTR and Error Propagation

In CTR mode, a single corrupted ciphertext bit flips exactly one plaintext bit. Errors don't propagate to other blocks (unlike CBC where block corruption garbles the next block). Good for noisy channels.

SIV Mode for Nonce Misuse Resistance

AES-SIV (Synthetic IV) is nonce-misuse resistant: even if the nonce is reused, only plaintext equality is revealed — not full plaintexts. Used in scenarios where nonce uniqueness is hard to guarantee.

From CTR to GCM

AES-GCM = AES-CTR + GHASH authentication. The counter mode handles encryption. GHASH computes an authentication tag using Galois field multiplication. Together: authenticated encryption.

Quick Check

What is the main advantage of CTR mode over CBC mode for bulk data encryption?

Answer it in the interactive lesson

Recap

CTR mode mastered! Next we combine it with authentication in AES-GCM to achieve Authenticated Encryption.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “CTR Mode & Stream-Cipher Behavior” lesson free?

Yes — the full text of “CTR Mode & Stream-Cipher Behavior” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “CTR Mode & Stream-Cipher Behavior”?

Use counter mode to turn a block cipher into a keystream generator. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “CTR Mode & Stream-Cipher Behavior” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy