Question on counter initial value for AES CTR on STM32WB

[PADAM.1]

Hello

In chapter 22.4.9 of RM0434 Rev6 is stated:

Counter: a 32-bit big-endian integer that is incremented each time a block

processing is completed. The initial value of the counter must be set to 1.

Why can be the initial value of the counter not be set to 0 (as far as I know it is possible in standard)? Is this a bug?

Best regards

Paul

[Nicolas ANQUET]

Hello Paul,

When initializing the AES for the first block what you are proposing makes sense. However, by doing as recommended in the RM0434, application can start AES-CTR computation at any block number (see principle of suspend-resume sequence).

Best regards,

Nicolas