# Reuse nonce with Salsa20 stream cipher with counter

It is often said to never use a nonce for more than one message when using a stream cipher. It seems this is to prevent something like this: Taking advantage of one-time pad key reuse? Yet what if I keep the same nonce, but increment the block counter depending on the amout of blocks exchanged so far? This should be the same thing as turning the whole exchange into one long message, thus not needing more than one IV. By exchange I mean two people sending each other stuff.

• a) doing this is likely going to be as hard as doing the same with IVs b) Can you be more precise into what this "block counter" is for you? – SEJPM Jan 28 '17 at 18:17
• Salsa20 internally uses a counter along with the nonce and the key to generate the cipher stream (to xor with your messages). The implementation I'm using allows to specify the counter. Specifying the counter allows you to decrypt/encrypt a block without having to decrypt all previous blocks. Usually, the counter is incremented for every generated block (every 512 bits). – Gordanothon John Jan 28 '17 at 18:26
• If you do what you propose you're basically back at CTR. There's a reason why you should not fiddle with this sort of internals. I can't right now but will write an answer soon (~30-60min) – SEJPM Jan 28 '17 at 18:28
• You won't gain anything with such approach. You risk reusing stream position and you are limited to 64bit space. So there is no point in doing so, except if you want to lose compability with some libraries. Use IV. – axapaxa Jan 28 '17 at 18:32
• Note: "It uses a dedicated 64-bit block counter to avoid incrementing the nonce after each block." - taken from the documentation of libsodium ( download.libsodium.org/doc/advanced/salsa20.html ). I'm not directly fiddling with the internals - just passing arguments (the ic argument) to the API. And I don't think a single transfer session is gonna exhost the entire 64bit space. If necessary, I can use carry-add on the counter and add the carry to the nonce. – Gordanothon John Jan 28 '17 at 18:44

[What] if I keep the same nonce, but increment the block counter depending on the amout of blocks exchanged so far?

What Salsa20 is doing can be considered to be "CTR-Mode like" $E_k(IV\parallel CTR)$ where you have to supply $k$ and $IV$.
If you were allowed to supply $IV'=IV\parallel CTR$ this would also mean you'd to absolutely make sure that no two blocks ever happen to share the same $IV'$ under the same key. Even worse to make sure this doesn't happen, you'd have to pick $IV'$ at random (or actually keep track of all the blocks encrypted under the key) as opposed to being able to just increment $IV$ (= uniqueness).