I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in decrypted form is the application RAM.

Now, when the application is launched, the user enters one decryption key and a nonce for each key. This is very uncomfortable, all the nonce are stored separately from the database where the encrypted keys are stored.

Is it safe to store nonce next to encrypted text? For example - nonce + ciphertext . That is, if an attacker has gained access to encrypted data, will it be easier for him to decrypt the keys if he knows the nonce? If not, then why do all libraries separate the nonce from the ciphertext, and not concatenate it?

  • $\begingroup$ Does this answer your question? What is the main difference between a key, an IV and a nonce?. Where did you see that they all are separating? You should say the libraries that I see ( with some lists) sperates... $\endgroup$
    – kelalaka
    Oct 6, 2021 at 15:33
  • $\begingroup$ @kelalaka pkg.go.dev/crypto/cipher#AEAD.Open and this example - gist.github.com/kkirsche/e28da6754c39d5e7ea10 $\endgroup$
    – riwasat604
    Oct 6, 2021 at 16:01
  • 1
    $\begingroup$ They are just examples of simple AES-GCM encryption. Nothing is serious. The only plausible reason is that they fear the IV/nonce-reuse of AES-GCM which can cause loss of confidentiality and forgeries. They may query the nonce/IV column to mitigate this. Instead one can use AES-GCM-SIV mode or XChaCha20-Poly1305 as a better alternative, 192-bit nonces. $\endgroup$
    – kelalaka
    Oct 6, 2021 at 16:18
  • $\begingroup$ @kelalaka But if I store the nonce together with the decryption key, and not concatenate it with the encrypted text, then it will be much more difficult for a hacker to hack the secret data? $\endgroup$
    – riwasat604
    Oct 6, 2021 at 19:52
  • 1
    $\begingroup$ The nonce doesn't mean to be secret. There is no secrecy on it. Just use a Master key and derive them? have you ever heard of password managers? Simply user have one strong master password ( possibly dicewire) and using HKDF to derive the master key, using this master key decrypt other keys and use them. $\endgroup$
    – kelalaka
    Oct 6, 2021 at 20:00


Browse other questions tagged or ask your own question.