As I understand it, reusing a (key, nonce, header data) triple in NORX leaks

  • the XOR of the initial common prefix (but this is zero, so only its length is leaked)
  • the XOR of the first distinct blocks (which is usable by an attacker)

Is this all NORX leaks if misused?


1 Answer 1


It depends on the attack model. In certain (realistic!) attack models, such as the one used for the BEAST and related attacks on TLS, security breaks down further—it becomes possible to decrypt messages in a byte-by-byte fashion!

This is not specific to NORX; any online authenticated encryption scheme will be vulnerable to the CPSS attack if misused repeatedly, though supposedly "misuse-resistant" modes do not lose security instantly (unlike e.g. AES-GCM). Modes that resist this kind of misuse necessarily need to perform two passes over the message, rendering them offline (i.e., the entire message must be accessible during encryption).

  • $\begingroup$ Note that NORX allows for a header to be part of the AD and guarantees full security if that is unique (as will always be the case in TLS). Also, one must reuse a nonce many times for this attack to work. $\endgroup$
    – Demi
    Feb 13, 2016 at 22:41
  • $\begingroup$ What is the "CPSS attack"? $\endgroup$
    – Melab
    Mar 22, 2018 at 16:45
  • $\begingroup$ Follow the link I posted in the response, Section 3. $\endgroup$ Mar 23, 2018 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.