# Nonce role on stream ciphers

Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for instance, this cost seems very high on HC-256 and negligible on Salsa 20). I would like to know the correct usage pattern of a nonce together with the stream cipher in a cryptosystem. The only thing I know for sure is that they must never repeat...

• Does it needs to be new for every transmitted message?
• It must be secret? (Is it assumed to be known by an attacker)?
-

Yes, no.

Does it needs to be new for every transmitted message?

Yes, always, otherwise this qualifies as IV reuse, the keystream produced by the stream cipher is the same (since keystream is independent of plaintext) and you end up with the familiar $M_0 \oplus M_1$.

I think you answered your own question here by noting that IV's must never repeat.

It must be secret? (Is it assumed to be known by an attacker)?

No, it can be made public and is generally transmitted along with the message. It is not a key. If it had to be kept secret, there wouldn't be much point in using one, as it would be equivalent to changing the key.

I should note this is a very common question here and will probably be closed as a duplicate:

Stream Cipher : Never use stream cipher key more than once

Why can't the IV be predictable when its said it doesn't need to be a secret?

Why is the IV passed in the clear when it can be easily encrypted?

What's is the main difference between a key, an IV and a nonce?

-
But a key/nonce pair can generate a very long pseudorandom stream, I thought I could simply go on generating more and more bytes for the messages as long as the message sequence is not lost... –  lvella Feb 25 '13 at 14:26
@Ivella: generating a long key stream for multiple messages is about the same as having only one really large message, so this is okay too. But then you'll have to make sure the messages stay in the same order. –  Paŭlo Ebermann Feb 25 '13 at 22:35
@Ivella In that case the offset in the keystream for each new message is equivalent to an IV (a variant of counter mode, but for stream ciphers). And as Paŭlo says, this has a few drawbacks. –  Thomas Feb 25 '13 at 23:15