# Is it safe for the ChaCha8 nonce to be deterministic?

ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions.

Is it safe to generate this nonce deterministically?

For example the first 6 bytes could be the number of milliseconds since the Unix epoch, with the last 2 bytes being an unsigned counter wrapping around. This will prevent any collisions from happening for 9000 years if no more than 65535 streams get encrypted in a millisecond (things get more complicated if the same encryption key is being used by multiple machines/threads, but let's ignore that for now).

• Use a larger nonce. See XSalsa20. Will post more tomorrow. – CodesInChaos Mar 1 '13 at 22:47
• You could expand the nonce size to 192 bits, similar to how XSalsa20 expands the nonce size of Salsa. – CodesInChaos Jun 1 '16 at 17:19
• @CodesInChaos "tomorrow" :P – orlp Jun 1 '16 at 17:43
• Procrastination... – CodesInChaos Jun 1 '16 at 17:46

Looking at the reference implementation, it looks like the IV is 64 bytes, not 8. In ECRYPT_ivsetup, it's a pointer to uint8_t, which is then treated as a pair of quartets (e.g., 8) of 8-byte values.