The CAESAR call for submissions specifies that ciphers may accept as a parameter a secret message number. The requirements are that:

  1. It must be possible to recover the plaintext and the secret message number from the ciphertext, associated data, public message number, and key;
  2. Ciphers may impose single-use requirements on the secret message number, but can't otherwise assume any specific generation scheme (e.g., counter or random selection);
  3. Ciphers must provide authenticity and confidentiality for the secret message number.

While this is quite clear about the requirements, I'm still at a loss at the purpose. What uses or features do such secret message numbers enable? Are there generic benefits to having such a message number, or is it something that individual ciphers would exploit for different ends?

Answers to the following older questions suggest that they may be used to provide some sort of nonce-reuse resistance or "hybrid encryption," but don't explain those scenarios in depth:

And scanning through the third-round candidates' submissions doesn't shed a lot of light either—most of them don't support secret message numbers, and the one or two that did provide it as an optional feature

  • $\begingroup$ given requirement 1, that you must be able to recover the secret from the ciphertext collection and key, I also do not see much use... since it is supposed to be secret $\endgroup$ Aug 27, 2016 at 0:46

1 Answer 1


DJB answers this question on the crypto-competions mailing list.

In short, the idea is that using counter as a nonce can leak information that would be better not leaked in real world conditions where an attacker may not have a copy of every message exchanged (or even if they do if e.g. a timestamp is used as counter). However, using a counter also makes it much easier to reject replays without the protocol designer needing to include a separate counter.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.