diff --git a/cbits/aes/aes.c b/cbits/aes/aes.c
--- a/cbits/aes/aes.c
+++ b/cbits/aes/aes.c
@@ -377,19 +377,19 @@
         block128_copy(block, (aes_block *)iv);
 
         for ( ; nb_blocks-- > 0; output += 16, input += 16) {
-                block128_inc_be(block);
                 encrypt_ecb(key, (uint8_t *)&o, (uint8_t *)block, 1);
                 block128_vxor((block128 *) output, &o, (block128 *) input);
+                block128_inc_be(block);
         }
 
         if ((len % 16) != 0) {
-                block128_inc_be(block);
                 encrypt_ecb(key, (uint8_t *)&o, (uint8_t *)block, 1);
                 for (i = 0; i < (len % 16); i++) {
                         *output = ((uint8_t *) &o)[i] ^ *input;
                         output += 1;
                         input += 1;
                 }
+                block128_inc_be(block);
         }
 }
 
diff --git a/cipher-aes128.cabal b/cipher-aes128.cabal
--- a/cipher-aes128.cabal
+++ b/cipher-aes128.cabal
@@ -2,7 +2,7 @@
 -- documentation, see http://haskell.org/cabal/users-guide/
 
 name:                cipher-aes128
-version:             0.3.2.1
+version:             0.4
 synopsis:            AES128 using AES-NI when available.
 description:         AES128 with crypto-api instances and a trampoline between Vincent Hanquez's C-based and x86 NI-based AES.  Patches welcome to add additional high-performance backends (ARM?)
 license:             BSD3