2
$\begingroup$

I need a nonce to encrypt my stuff using NaCl secretbox. I will be transmitting the nonce along with the ciphertext, which I have been told is OK to do. It occurs to me that one could simply use the hash of the plaintext as the nonce instead, since it will not collide and is easily accessible (I need to generate it anyway for something else). Somehow this strikes me as a possibly risky idea. Is this a bad thing to do?

$\endgroup$
  • 2
    $\begingroup$ An unkeyed hash of the plaintext leaks a lot of information about the plaintext. $\endgroup$ – CodesInChaos Jan 12 '15 at 14:44
2
$\begingroup$

In the traditional sense, a nonce is a number that is only used once (with the same key). Though occasionally there are other requirements. For example, we may require that the nonce be unpredictable. For more on this I recommend you read this answer and this answer.

Now, you don't go into enough detail on what you are doing to say whether or not you need unpredictability of the nonce. A hash of the plaintext (depending on how long the plaintext is) will not get you unpredictability. So, if you are using CBC mode, this is definitely risky.

More importantly, however, it is not clear whether you really get the "number used only once" property with your proposal. Will the same plaintext ever be sent encrypted with the same key? If the answer is that is it possible, then your idea is a bad thing to do. Exactly what the outcome would be depends on application level details (most importantly, what block cipher mode you are using) that you have not provided.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ The context is crucial in this context. If you use the nonce in a challenge-response way, then it is quite bad to make it deterministic in dependency of something else. This is an example for the "do you need the only used once" property. Something like this can be weak against replay attacks, for example. $\endgroup$ – tylo Jan 12 '15 at 13:55
  • $\begingroup$ If the same plaintext is encrypted with the same key, the same nonce will be reused -- but that just produces the same ciphertext twice. $\endgroup$ – Demi May 2 '16 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.