How does CTR (Counter) mode work and why is it popular?

CTR mode encrypts a counter value (IV + incrementing number) for each block to generate a keystream, making it fully parallelizable while acting as a stream cipher.

* CTR encrypts a per-block counter to make a keystream, so blocks are independent and fully parallelizable. *

How it works:

S_i = E(K, IV || counter_i)    (encrypt the counter)
C_i = M_i ⊕ S_i                (XOR with keystream)

Key advantages over other modes:

• Fully parallelizable — both encryption and decryption (unlike CBC encryption or OFB)
• Random access — can decrypt block i without decrypting blocks 1 to i-1
• Pre-computable — keystream can be generated before plaintext arrives
• No padding needed — can encrypt any length (just truncate the last keystream block)

Security requirement: The (IV, counter) combination must never repeat for the same key. Each encryption must use a unique IV.

Error behavior: Like OFB — a bit error in ciphertext only affects the corresponding plaintext bit. No error propagation.

CTR is the preferred mode in modern cryptography — used in AES-GCM (TLS 1.3), disk encryption, and more.

Go deeper:

• Block cipher mode of operation (Wikipedia) — CTR's random access, parallelism, and never-repeat rule.