Timeline for Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 15, 2019 at 18:44 | comment | added | Tom | @jnm2 you could use a trivial counter, such as the timestamp (rounded to full seconds or even minutes, if both systems are time-synchronized) or even just the day-of-year (if not and the edge case of one message being not decryptable because it was sent at just the right second doesn't matter). This would already dramatically reduce the chances of a chance repetition. | |
| Apr 15, 2019 at 14:01 | comment | added | jnm2 |
Good reminder. I can't use a counter since there is no context saved from one encryption to the next. This is a standalone tool with no central server to house a counter. The only options I know of are fixed nonce (e.g. zeros) and random nonce. The key is 256 bits and encryption will be occasional. The generator is BCryptGenRandom with BCRYPT_USE_SYSTEM_PREFERRED_RNG on Windows and OpenSSL on Unix.
|
|
| Apr 15, 2019 at 9:56 | comment | added | Tom | @MartinBonner - as written: weigh the advantage against the risk and make a decision. The OP doesn't specify his use case, which makes it difficult to be specific on the threat level. | |
| Apr 15, 2019 at 9:53 | comment | added | forest | @MartinBonner You can usually derive the nonce from the same master secret that the key is derived from. | |
| Apr 15, 2019 at 9:52 | comment | added | Martin Bonner supports Monica | The advantage of using a fixed nonce, is that you don't need to transmit it or store it. I presume this is enough of an advantage for the OP. | |
| Apr 15, 2019 at 7:49 | history | answered | Tom | CC BY-SA 4.0 |