In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.
However, is security affected for those messages encrypted with the same key but different nonces?
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ the nonce is the IV $\endgroup$– Richie FrameJan 21, 2016 at 8:44
-
2$\begingroup$ If you use different nonces your (key,nonce) pairs vary and therefore you're secure as noted in your first sentence... $\endgroup$– SEJPMJan 21, 2016 at 13:22
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality.
However, the attacker can also attack the MAC part (Poly1305) and generate a third and more messages with the same nonce. See: Why is Poly1305 popular given its 'sudden death' properties?
So unless you have a way to rule out messages with that nonce in the future, for example due to the protocol enforcing a new nonce each time, you cannot trust messages encrypted with that key any more. If you can rule them out, messages with other nonces cannot be forged, because the MAC key is generated from the encryption key and the nonce.
