I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case randomly generated) nonce, so I would just send it with the ciphertext. I derive the secret key with argon2id from a password, but this needs a salt. So I was wondering whether it would be dangerous to use parts of the nonce as the salt, so I only have to transmit the nonce. I don't think it would be problematic because the salt is just used to prevent rainbow table attacks etc. I know it is dangerous to reuse a (key,nonce)-pair, but since the key is derived from both a password and the salt and the nonce is randomly generated every time, I don't see this as a problem.

Am I correct or is there a problem I'm not thinking about? Or is there a better approach? Also I'm asking more from the academic side of things and less from my implementation, that was just to explain how I came to the question.

In case there is already a similar question, please point me towards it, I did try the search but nothing really fitting came up.

Tl;dr: Is it generally cryptographically problematic to use a part of nonce for an AEAD scheme as a salt for a KDF ?

  • $\begingroup$ It is not clear how you transmit the password to the other side to generate the same key. What not use crypto_box $\endgroup$
    – kelalaka
    Oct 20, 2020 at 8:27
  • $\begingroup$ @kelalaka You mean asymmetric encryption for key exchange or generation? Yeah, I could do that. Since I'm currently just playing with the functionality I was just assuming both sides know the password. But my question is more of an academic question, I don't care as much about how to do that practically, as whether that is theoretically a problem. $\endgroup$
    – user69188
    Oct 20, 2020 at 8:35
  • $\begingroup$ Then, you went out of the context. You have pre-shared key and the security must be considered on that. Are you hiding your actual problem? $\endgroup$
    – kelalaka
    Oct 20, 2020 at 9:04
  • $\begingroup$ I wanted, just for fun, implement a symmetric encryption 1-1 software. Use case: e.g. Two friends who want to share their data, they agreed on a password by talking to each other. While writing the software I found that I would need to share the nonce and when using the KDF also the salt and I just thought whether I could use part of the nonce as a salt so I wouldn't have to send both which would make parsing the file (which consists of ciphertext+nonce+salt if necessary) easier. The implementation is really just for fun and learning. $\endgroup$
    – user69188
    Oct 20, 2020 at 9:11
  • $\begingroup$ Use can use HKDF to derive many keys and nonces. $\endgroup$
    – kelalaka
    Oct 20, 2020 at 9:14

1 Answer 1


I derive the secret key with argon2id from a password, but this needs a salt. So I was wondering whether it would be dangerous to use parts of the nonce as the salt, so I only have to transmit the nonce.

Yes, the salt is used to eliminate the rainbow tables. Keep in mind that the rainbow tables can be build up to some degree. If we consider that the Bitcoin miners agree to build a rainbow table instead of mining, they can build a table the can most cover $\approx 2^{92.8}$ passwords in a year. This is not considered the case that the slowness of the password-based key derivation functions, like PBKDF2, scrypt, Argon2. If we consider that they are parametrized to slow like $2^{20}$ then the coverage is reduced to $\approx 2^{72.8}$.

Within the Kerckhoffs's_principles - that is all but the key is known to the attackers - the attackers will always choose the shortest path to achieve their target whenever they see that. If you use the nonce and send it in public, they will try to find it. If the password is not good, they will find it! However, if the passwords have good entropy like diceware or bip39 is used to generate one, there is no problem. Keep it above 128-bit entropy then your password is safe and the derived the key. Keep in mind that, the users tend to have bad passwords. Either you should educate them about using better passwords like generated by the diceware method or enforce them on some stupid rules that cause hard to remember passwords xkcd:936. In your case, you should generate a good one beforehand. You should also put an expire date-usage for the password, too. Or better, use a randomly generated key!.

Or is there a better approach?

Use Diffie-Hellman Key Exchange(DHKE) to exchange (establish better) the keys. One should prefer the Elliptic version of that ECDH. After the key is established then use HKDF to derive the key of the required length. Remember to use all of the exchanged keys. DHKE/ECDH That will provide you the forward secrecy as long as you and your friend deleted the keys after using them.

Actually, there is already a solution in the library; Crypto_box.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.