# Is it safe to reuse the same nonce for decryption an indefinite amount of times in this context?

I'm creating a password management application and I'm considering using the following procedure to keep passwords safe:

1. Asking the user for raw_password, for example "MyLongMasterKeyPassword"

2. Generating master_key from raw_password with Scrypt and a random salt

3. Storing the salt (kept public)

4. Asking for raw_message (the password to store)

5. Generating cipher using AEAD-ChaCha20Poly1305IETF and generating a random nonce, and then asking for AD(Additional authentication)

6. Storing the nonce

7. Encrypting raw_message with cipher, nonce, and AD, then using the nonce once for encryption, that returning cipher_text

8. Storing the cipher_text

9. Decrypting cipher_text with stored salt and nonce, then asking for AD and raw_password to regenerate the master_key with the stored salt, and then generating a cipher with the master_key and stored nonce, which returns the decrypted_message (a password, probably)

Now, the question is, is this procedure safe? Specifically, is it safe to re-use the same nonce for decryption an indefinite amount of times, if you only use it once for encryption?

• [Never use a nonce again with the same key ](crypto.stackexchange.com/q/78442/18298) – kelalaka Apr 5 '20 at 8:55
• @kelalaka even if it is only used for decryption? – Newbyte Apr 5 '20 at 9:19
• To use the same nonce in decryption you need to use the same nonce in encryption. – kelalaka Apr 5 '20 at 9:48
• @kelalaka The salt, cipher_text, and nonce are stored. The cipher_text will be encrypted once and decrypted multiple times, and the nonce is used in this process; thus, the nonce is only used once for encryption and an indefinite amount of times for decryption. Is this safe? – Newbyte Apr 5 '20 at 9:56
• Nonce = Number used once. The golden rule is a nonce must not be used under the same key again. This is for encryption. Nobody can prevent you from decrypting a ciphertext again and again. Theoretically decrypting once or twice or more are same. They should give the same results. – kelalaka Apr 5 '20 at 10:17