11
$\begingroup$

My question maybe will be stupid, but my problem is that I do not understand why stream ciphers need a key and also a nonce. As far as I understand, the keystream is generated with the nonce. The same key can be reused with a different nonce.

Wouldn't be simpler just to use a new key each time? If I understand good, to decrypt the message the recipient needs the nonce. Is communicating the nonce simpler than communicating the key?

$\endgroup$

1 Answer 1

16
$\begingroup$

By the modern definition of a cipher, it must be possible to encipher several messages with the same secret key. That's also a practical necessity, due to the difficulty of securely establishing a shared secret key. That issue is solved with the nonce, which is not secret, and can be transferred as part of the ciphertext (typically: at the beginning).

Without nonce, or if the nonce repeats, the keystream would repeat, and that would allow breaking the cipher, e.g. with a single known plaintext.

Because the nonce is not secret, communicating the nonce is simpler than securely communicating the key. Altering the nonce would alter the deciphered message, but a generic stream cipher is not supposed to allow detection of alterations anyway.

$\endgroup$
2
  • 1
    $\begingroup$ Can you elaborate a little further on why the keystream repeating would allow you to break it? Do you need both the keystream repeating and a guess about the plaintext? How much plaintext would you need to break the cipher? $\endgroup$ Jul 24, 2017 at 2:40
  • $\begingroup$ @Kevin Burke: the answer does NOT state that "the keystream repeating would allow you to break it", with it referring to keystream; that would be incorrect. The answer states that a repeating keystream would allow breaking the cipher. That stands per nearly all formal definition of cipher security, including IND-CPA (a common academic definition), and Known Plaintext. Fixed keystream also allows recovering most plaintext with minimal statistical knowledge about plaintext (being English text in ASCII) and a few ciphertexts. $\endgroup$
    – fgrieu
    Jul 24, 2017 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.