XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt

Question

Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay attack. In this scenario:

Is it better to XOR the nonce with the plain text and then encrypted the output to produce a cipher? Or XOR the nonce with the output cipher produced by encrypting the plain text? Which one would be more secure?

In my opinion, scheme 1- XORing the nonce with plain text and then encrypting the output seems to be a better option as it would produce a different cipher every time even if the plain text remains the same. Moreover, since the (nonce XOR plain text) goes through the permutation and substitution operations, the information about the nonce remains more secret. On the other hand, scheme 2 seems to be relatively less secure as the output (nonce XOR cipher) might give away some information about the generation of nonce (or about the PRNG or CSPRNG) if the attacker is able to collect enough cipher texts.

What do you think is the better way?

Answer 1

option 2 is insecure. Recall the nonce is public and must be sent with the ciphertext, which means it can be removed from the ciphertext trivially and therefor has no effect at all. You are effectively doing ECB with some useless extra step and extra communication.

Answer 2

Your scheme is overly simplified. Generally we don't have a nonce that is the same size as the plaintext. Most nonce's or IV's are just the size of a single block for a block cipher, or even smaller.

As Meir Maor already mentions, the second scheme offers no security whatsoever. However, the first scheme is near identical to CBC mode, so you'd require a fully unpredictable nonce to avoid known plaintext attacks. So without additional requirements, scheme 1 is insecure as well.

What is also missing is a scheme such as CTR mode where the nonce is made part of a counter, which is then encrypted to create a key stream. So that would be a nonce block pointing to your encryption block in the overly simplified scheme you've drawn.