0
$\begingroup$

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc.

Is it secure to send the nonce over the network along with the ciphertext? If not then why?

$\endgroup$
2
$\begingroup$

Yes, it is acceptable to send the nonce over the network when using ChaChaPoly1305. The nonce needs to be unique for every message encrypted with the same key, but the nonce does not need to be secret.

However, the RFC referenced in the question take a different approach. It does not suggest using a counter. That RFC uses information from the protocol that is available to both parties to construct the nonce. This allows a unique nonce to be constructed without additional protocol overhead and without requiring the sender to keep track of the counter separately. It does not harm the security of ChaChaPoly1305 if the protocol fields used to construct the nonce are sent in the clear.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.