Table 134. Ctr Mode Initialization Vector Definition; Figure 116. Ctr Encryption; Figure 117. Ctr Decryption - STMicroelectronics STM32WL5 Series Reference Manual

AES hardware accelerator (AES)
CTR encryption and decryption
Figure 116
respectively, as implemented in the AES peripheral. The CTR mode is selected by writing
010 to the CHMOD[2:0] bitfield of AES_CR register.
Legend
input
output
XOR
Legend
input
output
XOR
In CTR mode, the cryptographic core output (also called keystream) Ox is XOR-ed with
relevant input block (Px' for encryption, Cx' for decryption), to produce the correct output
block (Cx' for encryption, Px' for decryption). Initialization vectors in AES must be initialized
as shown in
AES_IVR3[31:0]
IVI[127:96]
664/1450
and Figure 117 describe the CTR encryption and decryption process,

Figure 116. CTR encryption

Nonce + 32-bit counter
AES_KEYRx (KEY)
AES_DINR (plaintext P1)
DATATYPE[1:0]
Swap
management
DATATYPE[1:0]
AES_DOUTR (ciphertext C1)

Figure 117. CTR decryption

Nonce + 32-bit counter
AES_KEYRx (KEY)
AES_DINR (ciphertext C1)
DATATYPE[1:0]
Swap
management
DATATYPE[1:0]
AES_DOUTR (plaintext P1)
Table 134.

Table 134. CTR mode initialization vector definition

AES_IVR2[31:0]
IVI[95:64]
Block 1
AES_IVRx
increment (+1)
I1
AES_KEYRx (KEY)
Encrypt
AES_DINR (plaintext P2)
O1
P1'
C1'
Swap
management
Block 1
AES_IVRx
increment (+1)
I1
AES_KEYRx (KEY)
Encrypt
AES_DINR (ciphertext C2)
O1
C1'
P1'
Swap
management
AES_IVR1[31:0]
IVI[63:32]
RM0453 Rev 5
Block 2
AES_IVRx
Nonce + 32-bit counter (+1)
Counter
Encrypt
DATATYPE[1:0]
Swap
management
P2'
Swap
DATATYPE[1:0]
management
AES_DOUTR (ciphertext C2)
Block 2
AES_IVRx
Nonce + 32-bit counter (+1)
Counter
Encrypt
DATATYPE[1:0]
Swap
management
C2'
Swap
DATATYPE[1:0]
management
AES_DOUTR (plaintext P2)
AES_IVR0[31:0]
32-bit counter = 0x0001
RM0453
I2
O2
C2'
MSv19102V3
I2
O2
P2'
MSv18942V2
IVI[31:0}