Is it OK to use a hash of the key as nonce for AES GCM?

I don't see an immediate risk of using the hash of the key as the nonce for AES GCM. Is there something I could be overlooking?

• Do you mean AES GCM mode? Jun 3 '15 at 18:47

I assume you mean AES-GCM.

Nonces must be unique for any use of a key. Given that $n = H(k)$ is constant for constant key $k$, this implies that such a nonce may only be used once, ever. Nonce reuse is particularly catastrophic in GCM mode (as with any other CTR-based mode), as it causes the keystream to be identical.

Essentially, you wind up with two (or more) ciphertexts $C_0 = K \oplus P_0$, $C_1 = K \oplus P_1$. An attacker can trivially compute

\begin{align} C_0 \oplus C_1 &= K \oplus P_0 \oplus K \oplus P_1\\ &= P_0 \oplus P_1 \oplus K \oplus K\\ &= P_0 \oplus P_1 \oplus 0\\ &= P_0 \oplus P_1 \end{align}

If an attacker can control the contents of any plaintext, it's trivially game over. Even in the event that an attacker can't, knowing the XOR of two plaintexts is almost inevitably enough to reconstruct the originals.

In general, nonces and IVs for any mode must be unique for any given key. In CTR-based modes, uniqueness is the only constraint placed on the nonce. Other modes may have more stringent requirements; for example, CBC requires IVs to be unpredictable by an attacker. Failure to follow these requirements can result in a complete break of the of the cipher.

• Thanks, that makes sense. But aren't we splitting hairs? You can essentially consider the nonce as being a second key that needs to be transmitted alongside the key? I don't see a situation where you would want to just update the nonce and not the key and vice versa. Jun 4 '15 at 14:19
• The nonce is typically transmitted along with the ciphertext — there is no requirement for it to be kept secret. Given what I provided above, it should be painfully obvious why you would want to use a variable nonce: to encrypt more than one plaintext with a single key. If any {key,nonce} pair is ever reused (particularly in CTR-based modes), secrecy of the messages the pair was used for is completely lost. Jun 4 '15 at 16:58
• Please also amend the question next time if it is found in error. Jun 6 '15 at 13:50

As pointed out the nonce must be unique so hash of key only is not going to work. You could however hash the key and plaintext together to produce a secure nonce: $n = H(m|k)$.

Note that this would still result in the same ciphertext for identical plaintext. So it doesn't fulfill the requirements for the ciphertext to be indistinguishable.

• That sounds pretty similar to SIV mode Jun 5 '15 at 23:54
• @RichieFrame Similar but not the same. And SIV mode implementations are scarce (something I'm trying to amend, although I'm not a huge fan). Jun 6 '15 at 13:53
• Amended answer. SIV mode without nonce is particularly used for wrapping of keys that contain a lot of entropy themselves. Richie is correct that this kind of matches at least the use case of SIV as wrapping primitive without the nonce. Jun 6 '15 at 13:58