stream ~key ~ctr n is the raw keystream.
Keystream is the concatenation of successive encrypted counter states. If
E(x) is the single block
x encrypted under
key, then keystream is the first
n bytes of
E(ctr) || E(add ctr 1) || E(add ctr 2) || ....
stream ~key ~ctr (k * block_size) || stream ~key ~ctr:(add ctr k) x == stream ~key ~ctr (k * block_size + x)
In other words, it is possible to restart a keystream at
block_size boundaries by manipulating the counter.
encrypt ~key ~ctr msg is
stream ~key ~ctr ~off (len msg) lxor msg.
next_ctr ~ctr msg is the state of the counter after encrypting or decrypting
msg with the counter
For protocols which perform inter-message chaining, this is the counter for the next message.
It is computed as
C.add ctr (ceil (len msg / block_size)). Note that if
len msg1 = k * block_size,
encrypt ~ctr msg1 || encrypt ~ctr:(next_ctr ~ctr msg1) msg2 == encrypt ~ctr (msg1 || msg2)