How does CTR (Counter) mode work and why is it popular?

CTR mode encrypts a counter value (IV + incrementing number) for each block to generate a keystream, making it fully parallelizable while acting as a stream cipher.

* CTR encrypts a per-block counter to make a keystream, so blocks are independent and fully parallelizable. *

How it works:

$$\begin{aligned} S_i &= E(K, IV \mathbin\Vert \text{counter}_i) && \text{(encrypt the counter)} \\ C_i &= M_i \oplus S_i && \text{(XOR with keystream)} \end{aligned}$$

Key advantages over other modes:

• Fully parallelizable — both encryption and decryption (unlike CBC encryption or OFB)
• Random access — can decrypt block $i$ without decrypting blocks $1$ to $i-1$
• Pre-computable — keystream can be generated before plaintext arrives
• No padding needed — can encrypt any length (just truncate the last keystream block)

Security requirement: The (IV, counter) combination must never repeat for the same key. Each encryption must use a unique IV.

Error behavior: Like OFB — a bit error in ciphertext only affects the corresponding plaintext bit. No error propagation.

CTR is the preferred mode in modern cryptography — used in AES-GCM (TLS 1.3), disk encryption, and more.

Go deeper:

• Block cipher mode of operation (Wikipedia) — CTR's random access, parallelism, and never-repeat rule.