3
$\begingroup$

Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for instance, this cost seems very high on HC-256 and negligible on Salsa 20). I would like to know the correct usage pattern of a nonce together with the stream cipher in a cryptosystem. The only thing I know for sure is that they must never repeat...

  • Does it needs to be new for every transmitted message?
  • It must be secret? (Is it assumed to be known by an attacker)?
Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

Yes, no.

Does it needs to be new for every transmitted message?

Yes, always, otherwise this qualifies as IV reuse, the keystream produced by the stream cipher is the same (since keystream is independent of plaintext) and you end up with the familiar $M_0 \oplus M_1$.

I think you answered your own question here by noting that IV's must never repeat.

It must be secret? (Is it assumed to be known by an attacker)?

No, it can be made public and is generally transmitted along with the message. It is not a key. If it had to be kept secret, there wouldn't be much point in using one, as it would be equivalent to changing the key.

I should note this is a very common question here and will probably be closed as a duplicate:

Improve this answer
$\endgroup$
4
  • $\begingroup$ But a key/nonce pair can generate a very long pseudorandom stream, I thought I could simply go on generating more and more bytes for the messages as long as the message sequence is not lost... $\endgroup$
    – lvella
    Feb 25, 2013 at 14:26
  • $\begingroup$ @Ivella: generating a long key stream for multiple messages is about the same as having only one really large message, so this is okay too. But then you'll have to make sure the messages stay in the same order. $\endgroup$
    – Paŭlo Ebermann
    Feb 25, 2013 at 22:35
  • $\begingroup$ @Ivella In that case the offset in the keystream for each new message is equivalent to an IV (a variant of counter mode, but for stream ciphers). And as Paŭlo says, this has a few drawbacks. $\endgroup$
    – Thomas
    Feb 25, 2013 at 23:15
  • $\begingroup$ Nit: keystream is not independent of plaintext with all stream ciphers. $\endgroup$
    – otus
    Nov 3, 2015 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.