title: Using the nonce and counter correctly for AES-CTR mode
body: <p>I understand that in AES Counter mode I need to use a 128 bit nonce. The naïve way to do that would be to use a random 128 bit nonce, but I'm not sure the algorithm will be able to increment the counter correctly if it's passed as all random bits. I thought the correct way to do it is to use a 96 bit nonce and also a 32 bit counter starting at 0, for example:</p>
  
  <pre><code>var key = CryptoJS.enc.Hex.parse('01ab23cd45ef67089a1b2c3d4e5f6a7b'); // 128 bits / 16 bytes
  var nonce = '2301cd4ef785690a1b2c3dab'; // 96 bits / 12 bytes
  var counter = '00000000'; // 32 bits / 4 bytes
  var nonceAndCounter = nonce + counter;
      nonceAndCounter = CryptoJS.enc.Hex.parse(nonceAndCounter);
  var plaintext = 'The quick brown fox jumps over the lazy dog.';
  
  var encryption = CryptoJS.AES.encrypt(plaintext, key, { iv: nonceAndCounter, mode: CryptoJS.mode.CTR, padding: CryptoJS.pad.NoPadding });
  var ciphertext = encryption.ciphertext.toString(CryptoJS.enc.Hex);
  </code></pre>
  
  <p>Is this the correct way to do it with the <a href="https://code.google.com/p/crypto-js/" rel="noreferrer">CryptoJS library</a>? Or what is the correct way?</p>