JohnDose:
In case you haven’t read, detailed specifications of file encryption can be found here:
No I didn’t.
The CTR mode is not bad in of itself. It’s parallelizeable i.e. you can use multiple CPUs to generate keystream blocks before XORing the plaintext. You just need to pair the CT with a MAC which they do:
The BLAKE3 MAC is generally secure, Encrypt-then-MAC is best practice. But…