# Using a nonce as a salt for key derivation

I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case randomly generated) nonce, so I would just send it with the ciphertext. I derive the secret key with argon2id from a password, but this needs a salt. So I was wondering whether it would be dangerous to use parts of the nonce as the salt, so I only have to transmit the nonce. I don't think it would be problematic because the salt is just used to prevent rainbow table attacks etc. I know it is dangerous to reuse a (key,nonce)-pair, but since the key is derived from both a password and the salt and the nonce is randomly generated every time, I don't see this as a problem.

Am I correct or is there a problem I'm not thinking about? Or is there a better approach? Also I'm asking more from the academic side of things and less from my implementation, that was just to explain how I came to the question.

In case there is already a similar question, please point me towards it, I did try the search but nothing really fitting came up.

Tl;dr: Is it generally cryptographically problematic to use a part of nonce for an AEAD scheme as a salt for a KDF ?

• It is not clear how you transmit the password to the other side to generate the same key. What not use crypto_box – kelalaka Oct 20 '20 at 8:27
• @kelalaka You mean asymmetric encryption for key exchange or generation? Yeah, I could do that. Since I'm currently just playing with the functionality I was just assuming both sides know the password. But my question is more of an academic question, I don't care as much about how to do that practically, as whether that is theoretically a problem. – user69188 Oct 20 '20 at 8:35
• Then, you went out of the context. You have pre-shared key and the security must be considered on that. Are you hiding your actual problem? – kelalaka Oct 20 '20 at 9:04
• I wanted, just for fun, implement a symmetric encryption 1-1 software. Use case: e.g. Two friends who want to share their data, they agreed on a password by talking to each other. While writing the software I found that I would need to share the nonce and when using the KDF also the salt and I just thought whether I could use part of the nonce as a salt so I wouldn't have to send both which would make parsing the file (which consists of ciphertext+nonce+salt if necessary) easier. The implementation is really just for fun and learning. – user69188 Oct 20 '20 at 9:11
• Use can use HKDF to derive many keys and nonces. – kelalaka Oct 20 '20 at 9:14

Yes, the salt is used to eliminate the rainbow tables. Keep in mind that the rainbow tables can be build up to some degree. If we consider that the Bitcoin miners agree to build a rainbow table instead of mining, they can build a table the can most cover $$\approx 2^{92.8}$$ passwords in a year. This is not considered the case that the slowness of the password-based key derivation functions, like PBKDF2, scrypt, Argon2. If we consider that they are parametrized to slow like $$2^{20}$$ then the coverage is reduced to $$\approx 2^{72.8}$$.