Table 319. Ctr Mode Initialization Vector Definition; Figure 517. Ctr Encryption; Figure 518. Ctr Decryption - ST STM32G4 Series Reference Manual

RM0440
Legend
input
output
XOR
Legend
input
output
XOR
In CTR mode, the cryptographic core output (also called keystream) Ox is XOR-ed with
relevant input block (Px' for encryption, Cx' for decryption), to produce the correct output
block (Cx' for encryption, Px' for decryption). Initialization vectors in AES must be initialized
as shown in
AES_IVR3[31:0]
Nonce[31:0]
Unlike in CBC mode that uses the AES_IVRx registers only once when processing the first
data block, in CTR mode AES_IVRx registers are used for processing each data block, and
the AES peripheral increments the counter bits of the initialization vector (leaving the nonce
bits unchanged).
CTR decryption does not differ from CTR encryption, since the core always encrypts the
current counter block to produce the key stream that is then XOR-ed with the plaintext (CTR

Figure 517. CTR encryption

Nonce + 32-bit counter
AES_KEYRx (KEY)
AES_DINR (plaintext P1)
DATATYPE[1:0]
Swap
management
DATATYPE[1:0]
AES_DOUTR (ciphertext C1)

Figure 518. CTR decryption

Nonce + 32-bit counter
AES_KEYRx (KEY)
AES_DINR (ciphertext C1)
DATATYPE[1:0]
Swap
management
DATATYPE[1:0]
AES_DOUTR (plaintext P1)
Table 319.

Table 319. CTR mode initialization vector definition

AES_IVR2[31:0]
Nonce[63:32]
Block 1
AES_IVRx
increment (+1)
I1
AES_KEYRx (KEY)
Encrypt
AES_DINR (plaintext P2)
O1
P1'
C1'
Swap
management
Block 1
AES_IVRx
increment (+1)
I1
AES_KEYRx (KEY)
Encrypt
AES_DINR (ciphertext C2)
O1
C1'
P1'
Swap
management
AES_IVR1[31:0]
Nonce[95:64]
RM0440 Rev 4
AES hardware accelerator (AES)
Block 2
AES_IVRx
Nonce + 32-bit counter (+1)
Counter
Encrypt
DATATYPE[1:0]
Swap
management
P2'
Swap
DATATYPE[1:0]
management
AES_DOUTR (ciphertext C2)
Block 2
AES_IVRx
Nonce + 32-bit counter (+1)
Counter
Encrypt
DATATYPE[1:0]
Swap
management
C2'
Swap
DATATYPE[1:0]
management
AES_DOUTR (plaintext P2)
AES_IVR0[31:0]
32-bit counter = 0x0001
I2
O2
C2'
MSv19102V3
I2
O2
P2'
MSv18942V2
1507/2126
1538