You are missing comments. At the very least I would expect a method comment explaining what CTR stands for (CTR mode? I'm not that familiar with that mode, but if it's like any other mode of operation, you are missing the actual block cipher, it seems).
Ideally, you would link to some documentation of the algorithm you are implementing as well. If none exists, describe your algorithm in-depth yourself.
Your variable names are pretty bad, making your code very hard to understand.
If these are the same names as names in some mathematical documentation, it may be ok, but you need to link to it.
If these names only occur in your code, you need to change them.
key is the only acceptable name you have,
sb are all not understandable without at least some context.
While your names are way too short, you do apply the
c suffix consistently, which is good.
Here are some possible improvement ideas:
plaintextCharacters (you may be able to come up with a better suffix than characters)
ciphertext (a reader doesn't really care that it's a string builder, but what the string builder actually contains)
keyCharacter (this is one item from the
kc array, and the name should reflect this)
inc: If you make your
foreach into a
for loop you wouldn't need this.
c: It's customary to use
i as index variable. Now I'm left wondering why you don't follow this custom. If you have a better name than
i, you should definitely use it, so if
c stands for something, write it out.
cc: see above, then append
i as index if there is nothing better is fine
modifiedKey or similar might be fitting
I haven't looked at the security aspect in-depth, but this question might interest you. Here it is also suggested to not start
c at 0 for every encryption.
Apart from that, Don't be a Dave and Don't roll your own (Although I'm assuming that this is for educational purposes only).