CTR and GCM Modes

CTR (Counter): turn AES into a stream cipher. Encrypt a counter, XOR with plaintext.

ciphertext_i = plaintext_i XOR AES(nonce || counter_i)

• Parallelizable (each block independent of others)
• No padding needed (XOR works for partial blocks)
• Same nonce + counter = same keystream — NEVER reuse a (key, nonce) pair

CTR with HMAC over the ciphertext = encrypt-then-MAC = secure authenticated encryption.

GCM (Galois/Counter Mode): CTR + a GHASH for integrity in one mode. The standard for new applications.

ciphertext = CTR_encrypt(plaintext, key, nonce)
tag = GHASH(ciphertext + AAD, H, J0)   (authenticator)
output = (nonce, ciphertext, tag)

AAD (Associated Authenticated Data): authenticated but not encrypted — e.g., the packet header.

Verification:

recompute_tag = GHASH(received_ciphertext + AAD, H, J0)
if recompute_tag == received_tag:
    plaintext = CTR_decrypt(ciphertext, key, nonce)
else:
    REJECT

GCM is in TLS 1.2+, IPsec, SSH, and most modern protocols. Never decrypt a GCM ciphertext if the tag fails — that opens a padding-oracle equivalent.

Modern alternatives: ChaCha20-Poly1305 (faster on devices without AES hardware), AES-GCM-SIV (nonce-misuse-resistant).