# JOSE: JWE CEK Initialization Vector Position or Reuse

So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content.

My issue however is that NaCl needs an IV (nonce in NaCl) for both the asymmetric encryption of the key and the symmetric encryption of the content.

Looking at other examples such as the ietf-jose cookbook, (X25519, A128GCM), they only have the one "top level" IV.

Is it ok to use the same IV for both the x25519 and the A256GCM?

If not, where does the IV for the x25519 get placed in the JWE?

Or is there something else I am missing entirely?

{
enc: "A256GCM",
alg: "ECDH-ES",
epk: {
crv: "X25519",
kty: "OKP",
x: ephemPublicKey
iv: "Perhaps we stuff the X25519 iv here?",
},
iv: "Perhaps we stuff the X25519 iv here?",
encrypted_key,
},
ciphertext,
tag,
iv: "iv for the A256GCM only or both?",
}

• Where did you see that X25519 needs for an IV/Nonce? By the way, the A128GCM should be AES128-GCM. – kelalaka Jun 16 at 19:22
• @kelalaka TweetNaCl.js requires it (x25519-xsalsa20-poly1305): github.com/dchest/… – Wil W Jun 17 at 13:30
• @kelalaka of course now I see I wasn't actually doing just x25519, but x25519-xsalsa20-poly1305. Perhaps there just isn't a standard for doing x25519-xsalsa20-poly1305 with AES-256-GCM because why add the additional layer? – Wil W Jun 17 at 13:43
• If you look at NaCl page, you will see that x25519 for ECDH key exchange, xsalsa20 is a stream cipher and poly1305 is for mutual authentication. – kelalaka Jun 17 at 14:16