stream ~key ~ctr ~off n is the first n bytes obtained by encrypting and concatenating blocks c(0), c(1), ..., where c(0) is ctr, and c(n + 1) is c(n) + 1 interpreted in big-endian.
If off is greater than 0 then the result is the last n bytes of an off + n bytes long stream. Thus, stream ~key ~ctr ~off:0 n || stream ~key ~ctr ~off:n n ==
stream ~key ~ctr ~off:0 (n*2).
ctr has to be block-sized, and off and n need to be non-negative.
encrypt ~key ~ctr ~off msg is (stream ~key ~ctr ~off (len msg)) xor msg.