encryption - openssl aes_128_ctr in c -

i have 1mb size data , want use aes_128_ctr encrypt. found source code in openssl follow.

/* input encrypted though 128bit counter mode being  * used.  state information record how of  * 128bit block have used contained in *num, ,  * encrypted counter kept in ecount_buf.  both *num ,  * ecount_buf must initialised zeros before first  * call aes_ctr128_encrypt().  */ void aes_ctr128_encrypt(const unsigned char *in, unsigned char *out,     const unsigned long length, const aes_key *key,     unsigned char counter[aes_block_size],     unsigned char ecount_buf[aes_block_size],     unsigned int *num) {      unsigned int n;     unsigned long l=length;      assert(in && out && key && counter && num);     assert(*num < aes_block_size);      n = *num;      while (l--) {         if (n == 0) {             aes_encrypt(counter, ecount_buf, key);             aes_ctr128_inc(counter);         }         *(out++) = *(in++) ^ ecount_buf[n];         n = (n+1) % aes_block_size;     }      *num=n; } 

my question is: in order encrypt entire 1mb data, need use while loop encrypt every 128-bit? can call function once setting length (1024 * 1024 / 16)? , don't understand *num do. can explain me?

you can in 1 go. first initialise aes_key key (for encryption) , before encryption memset(ecount_buf,0,aes_block_size);unsigned int num=0; , fill counter buffer counter value file.

then call aes_ctr128_encrypt(in,out,length, &key,counter,ecount_buf,&num); length length in bytes 1024 * 1024.

if append data file later can go on counter, ecount_buf value , num value after call. these values modified during function's inner working.

they needed because if encrypt 15 bytes in counter mode , want add 15 later, after, still need encrypted counter value used first 15 bytes encrypt 16th byte (the block not used yet), after first encryption num 15, keep track of this. counter gets updated, encrypted new value, , used next 14 bytes, , num becomes 14, etc. if you're never going append data file, out ready, zeroise num, count_buffer , counter after encrypt call, , forget them.

it might less confusing use evp interface algorithms instead, keeps track of stuff in own context (look in evp.h).