4
$\begingroup$

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost.

If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep state between encryptions. I am looking for algorithms that

  • have a large IV — specifically, one large enough that using a CSPRNG to generate a fresh IV each time is secure.
  • provide authentication.
  • have easy-to-use, well-regarded, portable open-source implementations that are resistant to timing attacks.

The reason for these requirements is that I am looking for an implementation that is (relatively) hard to misuse and works just about anywhere — and that is written by an expert cryptographer.

I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 – and then transmitting it) but I am not a cryptographer so I don't trust them.

$\endgroup$
  • $\begingroup$ XSalsa20/XChaCha20 have a large enough IV. $\endgroup$ – CodesInChaos Dec 16 '15 at 22:47
  • $\begingroup$ @CodesInChaos is it okay to simply send this IV in the clear with an HMAC for integrity? $\endgroup$ – Demi Dec 16 '15 at 23:00
  • 2
    $\begingroup$ You could simply use XSalsa20Poly1305, which is authenticated encryption with a 192 bit IV. $\endgroup$ – CodesInChaos Dec 16 '15 at 23:47
3
$\begingroup$

Let's look at your requirements:

have a large IV — specifically, one large enough that using a CSPRNG to generate a fresh IV each time is secure.

Generally, IVs/nonces longer than 96 bits are thought to be okay for random generation. If it is at least 128 bits you can safely use it as long as you can a 128-bit block cipher like AES, because before you run into random nonce collisions you already have random block collisions.

Shorter nonces, such as the 64-bit nonce in Salsa20 and ChaCha cannot be used as freely, since you would expect a collision after a few billion ($10^9$) messages and after just millions with non-negligible probability.

provide authentication.

Unless you want to compose your own authenticated encryption using a cipher and a MAC, this basically leaves you with one option that is in common use: AES-GCM. ChaCha20Poly1305 is also in common use (TLS), but has a short 64-bit nonce. XSalsa20Poly1305, which CodesInChaos mentions, is also an option, but basically only used in NaCl/libsodium as far as I know.

The X in XSalsa20 is important. That algorithm has a 192-bit nonce. That long nonce allows you to e.g. use a 128-bit random value and a 64-bit timestamp, making collisions unlikely even in the case of a deficient RNG.

have easy-to-use, well-regarded, portable open-source implementations that are resistant to timing attacks.

This is a bit off topic here, but again, AES-GCM and XSalsa20Poly1305 both have open source implementations. E.g. libsodium has implementations of both.


I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 – and then transmitting it) but I am not a cryptographer so I don't trust them.

This does not seem to accomplish anything. IVs do not need to be secret and ChaCha20 itself requires a (short) nonce.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.