Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for instance, this cost seems very high on HC-256 and negligible on Salsa 20). I would like to know the correct usage pattern of a nonce together with the stream cipher in a cryptosystem. The only thing I know for sure is that they must never repeat...

  • Does it needs to be new for every transmitted message?
  • It must be secret? (Is it assumed to be known by an attacker)?
share|improve this question
up vote 3 down vote accepted

Yes, no.

Does it needs to be new for every transmitted message?

Yes, always, otherwise this qualifies as IV reuse, the keystream produced by the stream cipher is the same (since keystream is independent of plaintext) and you end up with the familiar $M_0 \oplus M_1$.

I think you answered your own question here by noting that IV's must never repeat.

It must be secret? (Is it assumed to be known by an attacker)?

No, it can be made public and is generally transmitted along with the message. It is not a key. If it had to be kept secret, there wouldn't be much point in using one, as it would be equivalent to changing the key.

I should note this is a very common question here and will probably be closed as a duplicate:

share|improve this answer
But a key/nonce pair can generate a very long pseudorandom stream, I thought I could simply go on generating more and more bytes for the messages as long as the message sequence is not lost... – lvella Feb 25 '13 at 14:26
@Ivella: generating a long key stream for multiple messages is about the same as having only one really large message, so this is okay too. But then you'll have to make sure the messages stay in the same order. – Paŭlo Ebermann Feb 25 '13 at 22:35
@Ivella In that case the offset in the keystream for each new message is equivalent to an IV (a variant of counter mode, but for stream ciphers). And as Paŭlo says, this has a few drawbacks. – Thomas Feb 25 '13 at 23:15
Nit: keystream is not independent of plaintext with all stream ciphers. – otus Nov 3 '15 at 5:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.