Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be disastrous). In environments where using a simple counter is not an option, consider the following construction:
- staticKey: 256 bit cryptographically secure pseudorandom key
- perEncryptionSalt: 128 bit random salt
- perEncryptionKey: HKDF(staticKey, perEncryptionSalt, info)
- perEncryptionNonce: 64 bit random nonce
Ciphertext = chacha20(clearText, perEncryptionKey, perEncryptionNonce)
The salt and nonce would be appended to the ciphertext and included in the mac. Given that the key changes with each encryption (and thus would unlikely ever be used in combination with the same nonce), is this construction safe? I'm aware of XChacha20/XSalsa20 and they already solve this problem, but I'm curious nonetheless.