# Is it safe to use many nonces for XChaCha20?

I have a very simple question. Since XChaCha20 nonces are 192-bit, there's technically no limitation to the max number of message encrypted, since the chances of two random nonces being the same are very very tiny. Is it okay to use the same key, but difference nonces to encrypt large files in chunks? Basically, I read the large file 1KB at a time, encrypt with the same key but random nonce. If the file is 1GB, then I would have used 1000000 nonces. If I encrypted in chunks of 1MB, then I would've used 1000 nonces. Is doing this secure? (Assume everything is authenticated and I use CSPRNGs for nonces)

• Mar 26 at 8:56
• Actually, you don't need that. You can still use the same key and nonce, too Mar 26 at 10:01
• @kelalaka Just making sure, from what I understand from your last comment is that I just concatenate a counter to the ciphertext before MACing. If one of the blocks was rearranged, then the counter wouldn't be the same and therefore the MAC wouldn't match. Am I right? Thank you. Mar 26 at 18:28
• Not exactly ( there was a typo that was corrected), they are added into the plaintext to hide. Only the first and last indicators exist in the associated data. You can design one with only the associated data, too. Associated data is only MACed, not encrypted. Libsodium's secretstream API is already implemented for everybody. What is not working for you there? Mar 26 at 18:34
• Well, Bernstein is the creator of NaCl you want something more? Mar 26 at 18:43

• Seconded for using the secretstream API. Building this yourself comes along with a lot of footguns. Mar 26 at 4:48