DocID018909 Rev 11
725/1731
RM0090
Cryptographic processor (CRYP)
757
Figure 227. AES-CTR mode decryption
1. K: key; C: cipher text; I: input Block; o: output block; Ps: plain text before swapping (when decoding) or
after swapping (when encoding); Cs: cipher text after swapping (when decoding) or before swapping (when
encoding); P: plain text; IV: Initialization vectors.
shows the structure of the IV block as defined by the standard [2]. It is composed
of three distinct fields.
Figure 228. Initial counter block structure for the Counter mode
•
Nonce is a 32-bit, single-use value. A new nonce should be assigned to each different
communication.
•
The initialization vector (IV) is a 64-bit value and the standard specifies that the
encryptor must choose IV so as to ensure that a given value is used only once for a
given key
•
The counter is a 32-bit big-endian integer that is incremented each time a block has
been encrypted. The initial value of the counter should be set to ‘1’.
The block increments the least significant 32 bits, while it leaves the other (most significant)
96 bits unchanged.
).&)&/
!%!ENCRYPT
&ELWV
/54&)&/
3VELWV
CIPHERTEXT0
PLAINTEXT#
SWAPPING
)6,2
,ELWV
$+%GDWDZULWH
EHIRUH&5<3
LVHQDEOHG
,LVZULWWHQ
EDFNLQWR,9
DWVDPHWLPH
WKDQ3LVSXVKHG
LQ287),)2
SWAPPING
3ELWV
'$7$7<3(
'$7$7<3(
+
RU
&VELWV
2ELWV
-36
.ONCE
BITS
)NITIALIZATIONVECTOR)6
BITS
#OUNTER
BITS
AI