# Symmetric encryption algorithms with large IVs and authentication?

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost.

If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep state between encryptions. I am looking for algorithms that

• have a large IV — specifically, one large enough that using a CSPRNG to generate a fresh IV each time is secure.
• provide authentication.
• have easy-to-use, well-regarded, portable open-source implementations that are resistant to timing attacks.

The reason for these requirements is that I am looking for an implementation that is (relatively) hard to misuse and works just about anywhere — and that is written by an expert cryptographer.

I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 – and then transmitting it) but I am not a cryptographer so I don't trust them.

• XSalsa20/XChaCha20 have a large enough IV. – CodesInChaos Dec 16 '15 at 22:47
• @CodesInChaos is it okay to simply send this IV in the clear with an HMAC for integrity? – Demi Dec 16 '15 at 23:00
• You could simply use XSalsa20Poly1305, which is authenticated encryption with a 192 bit IV. – CodesInChaos Dec 16 '15 at 23:47

have a large IV — specifically, one large enough that using a CSPRNG to generate a fresh IV each time is secure.

Generally, IVs/nonces longer than 96 bits are thought to be okay for random generation. If it is at least 128 bits you can safely use it as long as you can a 128-bit block cipher like AES, because before you run into random nonce collisions you already have random block collisions.

Shorter nonces, such as the 64-bit nonce in Salsa20 and ChaCha cannot be used as freely, since you would expect a collision after a few billion ($10^9$) messages and after just millions with non-negligible probability.

provide authentication.

Unless you want to compose your own authenticated encryption using a cipher and a MAC, this basically leaves you with one option that is in common use: AES-GCM. ChaCha20Poly1305 is also in common use (TLS), but has a short 64-bit nonce. XSalsa20Poly1305, which CodesInChaos mentions, is also an option, but basically only used in NaCl/libsodium as far as I know.

The X in XSalsa20 is important. That algorithm has a 192-bit nonce. That long nonce allows you to e.g. use a 128-bit random value and a 64-bit timestamp, making collisions unlikely even in the case of a deficient RNG.

have easy-to-use, well-regarded, portable open-source implementations that are resistant to timing attacks.

This is a bit off topic here, but again, AES-GCM and XSalsa20Poly1305 both have open source implementations. E.g. libsodium has implementations of both.

I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 – and then transmitting it) but I am not a cryptographer so I don't trust them.

This does not seem to accomplish anything. IVs do not need to be secret and ChaCha20 itself requires a (short) nonce.