In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.

However, is security affected for those messages encrypted with the same key but different nonces?

  • 1
    $\begingroup$ the nonce is the IV $\endgroup$ Jan 21 '16 at 8:44
  • 2
    $\begingroup$ If you use different nonces your (key,nonce) pairs vary and therefore you're secure as noted in your first sentence... $\endgroup$
    – SEJPM
    Jan 21 '16 at 13:22

If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality.

However, the attacker can also attack the MAC part (Poly1305) and generate a third and more messages with the same nonce. See: Why is Poly1305 popular given its 'sudden death' properties?

So unless you have a way to rule out messages with that nonce in the future, for example due to the protocol enforcing a new nonce each time, you cannot trust messages encrypted with that key any more. If you can rule them out, messages with other nonces cannot be forged, because the MAC key is generated from the encryption key and the nonce.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.