Should Increment functions be near-constant time?
Actually, Maarten isn't quite correct; in most cases, the counter doesn't have to be updated in constant time (because it's not secret); however in one case it does: GCM with an IV size that's not 12 bytes.

The reason the counter needs to be secret in this case is not because how it is used, but how it is generated.  It is initialized to $GHASH_H(IV||0^{s+64}||len(IV))$; if the attacker can learn the lower bits of this value (based on whether or not an internal carry has occurred), he can gain information on the internal value of $H$, and if we can fully recover that, then he can forge.

In this (admitedly obscure) case, it would be wise to fully disguise whether the carry occurred.  Here is some code that should be safe on most processors to do that:

void IncrementCounterByOne(byte *inout, unsigned int size)
{
    for (int i=int(size-1), carry=1; i&gt;=0; i--) {
        int t = inout[i] + carry;
        inout[i] = t &amp; 0xff;
        carry = t &gt;&gt; 8;
    }
}


It runs slower than your code (because it reads and writes every byte); however it avoids data dependent operations (on most CPUs and compilers)