I am just getting started with cryptography. After doing some research, I see that people usually advice against encryption using the same key and nonce. However if a message is too long and has to be broken up into multiple packets, how exactly does this work? Will a different key and nonce be generated for each packet with a distinct authentication tag computed for that packet? Would it be considered secure to generate a key for the entire message, but each packet will be encrypted using a different nonce, and once the entire message is encrypted, the authentication tag is computed.

Thanks in advance.


1 Answer 1


Typical AEAD (authenticated encryption with associated data) algorithms support 96-bit nonce - quite large, and a counter is good for it. So if you have different nonce for each encryption, you don't have to change the key. What's more, AES requires key expansion for computing key schedule, which is an expensive operation if done each time.

You've probably mis-interpreted "not using the same key and nonce". What it means is that each "key-nonce" pair must be unique, not both of them must be different.

  • $\begingroup$ Ah I see. Indeed, I misunderstood what is meant by "the same key and nonce". Thank you so much! $\endgroup$ Jul 29, 2023 at 13:22
  • $\begingroup$ However, rekeying is better for security, which is why it's done by AES-GCM-SIV. $\endgroup$ Aug 1, 2023 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.