0
$\begingroup$

This question already has an answer here:

what is the source of nonce in SALSA20 algorithm. basically who provides the value of nonce in SALSA20 algorithm

$\endgroup$

marked as duplicate by e-sushi, Ilmari Karonen, DrLecter, Gilles 'SO- stop being evil', user991 Nov 17 '14 at 0:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3
$\begingroup$

The treatment of nonces is the same for most stream ciphers, they only differ in length. In the case of Salsa20 the nonce is 64 bits, and there is a related cipher XSalsa20 which extends the nonce to 192 bits.

The caller/application provides the nonce. Typically the protocol or file format you're implementing specifies how to treat the nonce.

The essential property you need to ensure is that you never reuse a (key,nonce) pair.

Sometimes you use a counter, for example the message number in a network protocol. This counter can be used to prevent replay attacks.
Sometimes you use a random value which is convenient when you want to avoid state. But that requires XSalsa20 not Salsa20, since to be likely unique a random value should have 128 bits and Salsa20 only has a 64 bit nonce.


An addition warning if you're using the asymmetric box function: Both directions (A->B and B->A) generate the same XSalsa20 key so a nonce used in one direction must not be reused in the other direction. Typically that's achieved by either using different keys for both directions or by use non overlapping nonce spaces.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.