Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality?

In this question it would be allowed for the streaming mode to leak if ciphertexts are (partially) identical or not - like in CBC mode of operation. It is of course not permitted to introduce other secrets or random values other than the key and original nonce.

I've got the feeling that this is only possible by mixing in information from the plaintext, but that would make the cipher much less efficient.

share|improve this question
A blockcipher in CFB mode only leaks the xor of the first block that differs and not the xor of the whole message. I think keccak's duplex mode has similar properties. – CodesInChaos Aug 10 '14 at 18:19
The SIV mode (Synthetic IV) is designed as misuse resistant, but it requires the plaintext to be processed twice. So probably not what you are looking for. – Thor Aug 10 '14 at 18:44
@Thor SIV actually comes a long way. It seems size efficient, but not very efficient with regards to CPU time. Thanks! – Maarten Bodewes Aug 11 '14 at 0:22
When I thought about this before, the candidate that I came up with was letting each block's key be the result of applying a PRF to the previous block (starting with the IV). $\;$ – Ricky Demer Aug 11 '14 at 5:21
Regarding CFB, cf.… – otus Aug 11 '14 at 5:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.