AesCtrParams

Draft
This page is not complete.

Secure context
This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.

This dictionary represents the object that should be passed as the algorithm parameter into SubtleCrypto.encrypt(), SubtleCrypto.decrypt()SubtleCrypto.wrapKey(), or SubtleCrypto.unwrapKey(),  when using the AES-CTR algorithm.

AES is a block cipher, meaning that it splits the message into blocks and encrypts it a block at a time. In CTR mode, every time a block of the message is encrypted, an extra block of data is mixed in. This extra block is called the "counter block".

A given counter block value must never be used more than once with the same key:

  • given a message n blocks long, a different counter block must be used for every block.
  • if the same key is used to encrypt more than one message, then for all blocks across all messages, a different counter block must be used.

Typically this is achieved by splitting the initial counter block value into two concatenated parts:

  • a nonce (that is, a number that may only be used once). The nonce part of the block stays the same for every block in the message. Each time a new message is to be encrypted, a new nonce is chosen. Nonces don't have to be secret, but they must not be reused with the same key.
  • a counter. This part of the block gets incremented each time a block is encrypted.

Essentially: the nonce should ensure that counter blocks are not reused from one message to the next, while the counter should ensure that counter blocks are not reused within a single message.

See Appendix B of the NIST SP800-38A standard for more information.

Properties

name
DOMString. This should be set to "AES-CTR".
counter
BufferSource. The initial value of the counter block. This must be 16 bytes long (the AES block size). The rightmost length bits of this block are used for the counter, and the rest is used for the nonce. For example, if length is set to 64, then the first half of counter is the nonce and the second half is used for the counter.
length
Number. The number of bits in the counter block that are used for the actual counter. The counter must be big enough that it doesn't wrap: if the message is n blocks and the counter is m bits long, then the following must be true: n <= 2m. The NIST SP800-38A standard, that defines CTR, suggests that the counter should occupy half of the counter block (see Appendix B.2), so for AES it would be 64.

Examples

Specifications

Specification Status Comment
Web Cryptography API
The definition of 'SubtleCrypto.AesCtrParams' in that specification.
Recommendation  

Browser compatibility

No compatibility data found. Please contribute data for "api.SubtleCrypto.encrypt.algorithm-aes-ctr" (depth: 1) to the MDN compatibility data repository.

See also

Document Tags and Contributors

Contributors to this page: wbamberg
Last updated by: wbamberg,