Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

0
votes
1answer
60 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
1
vote
2answers
402 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
0
votes
0answers
40 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
6
votes
3answers
1k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
2
votes
1answer
107 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
2
votes
1answer
136 views

Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant? I'm thinking of something like the following AEAD-like scheme: ...
0
votes
1answer
58 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
-4
votes
1answer
85 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
3
votes
1answer
183 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
48 views

What happens when a nonce is reused (WPA2)

I am trying to understand the KRACK on WPA2. But in their paper (PDF) it just simply states that By forcing nonce reuse in this manner, the encryption protocol can be attacked. But I cannot find ...
0
votes
0answers
288 views

Preventing replay attacks in a Web API that uses AES256

Background I am creating a Web API where both the request parameters and the response body are encrypted using AES-256-GCM. Vulnerability However, it is vulnerable to replay attacks. If someone ...
1
vote
1answer
153 views

regarding nonce and secret key

Consider the following challenge-response protocol for $A$ to convince $B$ that he is indeed $A$. Here we are assuming: at the start when the virtual circuit is being set up, $A$ has to convince $B$ ...
4
votes
1answer
572 views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
1
vote
1answer
144 views

How used nonce in CTR Mode of AES-EAX Encryption?

I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
1
vote
1answer
175 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...
1
vote
0answers
116 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
6
votes
1answer
620 views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
4
votes
1answer
878 views

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
2
votes
2answers
395 views

Can One-time-password be used as nonce in HMAC to prevent replay?

Note: In the following post OTP = one-time-password I am working on a project wherein I need send one way messages between two end points. There is already a shared secret via a side channel between ...
1
vote
1answer
1k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
0
votes
0answers
45 views

Is it possible to detect the same plaintext hashed with a different nonce

If an attacker has the $ hash(x) $ and the $ hash(x + nonce) $ is it possible for them to know the they are both a hash of $ x $ if the attacker dosnt know $ x$ ? Or is this prevented by the avalanche ...
1
vote
1answer
383 views

How to find the secret key and nonce from two messages encrypted using the same nonce?

As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken. If I use NaCl's crypto_box http://nacl.cr.yp.to/...
4
votes
1answer
213 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
8
votes
3answers
344 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
-1
votes
1answer
130 views

Why using a nonce not more than once in SSL/TLS

Why it is highly recommended to use a nonce once and only once in SSL/TLS? Same question with key streams in stream ciphers? What sort of attack(s) could take place if ever a nonce/key stream is used ...
7
votes
1answer
173 views

Difference between Tweak and nonce

What are diffrences between tweak and nonce? I only know that nonce is used only once but tweak can be used for more than one time.but still by this diffrence I can't diffrentiate tweak and nonce
7
votes
1answer
290 views

Why does SpongeWrap not need a Nonce?

The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined. What is ...
8
votes
1answer
720 views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
3
votes
1answer
92 views

What is a nonce-respecting adversary?

The NORX8 paper says It is assumed that adversaries are nonce-respecting. What is a nonce-respecting adversary?
4
votes
1answer
334 views

Nonce reuse resistance

I read this article and I think the approach outlined there is very interesting for one of our use case. We use ChaCha20 Poly1305 (via Sodium ...
7
votes
2answers
649 views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
4
votes
1answer
309 views

Why is a nonce used to initialize Hash_DRBG, HMAC_DRBG, and CTR_DRBG?

In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation. I understand the usual application for a nonce to prevent replay attacks. However,...
1
vote
0answers
584 views

ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal: $$ Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
5
votes
2answers
268 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
8
votes
1answer
229 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
1
vote
1answer
214 views

Reuse nonce with Salsa20 stream cipher with counter

It is often said to never use a nonce for more than one message when using a stream cipher. It seems this is to prevent something like this: Taking advantage of one-time pad key reuse? Yet what if I ...
4
votes
1answer
454 views

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 ...
1
vote
0answers
123 views

How to produce a message digest?

I've been trying this problem: Use the prototype function to hash message bit string into a length 16 message digest. Append (at the right end) the shortest nonce to the string (the spaces are ...
1
vote
1answer
55 views

As a cryptographic primitive, what does a nonce provide?

As a cryptographic primitive, what does a nonce provide? It seems like, at least in my understanding of it, a nonce by itself would not provide any sort of cryptographic usefulness, compared with ...
4
votes
1answer
2k views

What advantage is there for using a nonce and a timestamp?

I know both nonces and timestamps are used to prevent replay attacks, and nonces may offer increased security in the situation a message could be replayed with the timestamp in the allowable window. ...
1
vote
1answer
753 views

Counter Mode Known plain text attacks

Counter mode uses a counter that is incremented for each block. Doesnt predictability of this counter expose the scheme to attack? I mean if you are incrementing some nonce, then I have a good chance ...
6
votes
1answer
780 views

What is the purpose of the “Explicit Nonce” in TLS for AES-GCM and AES-CCM?

TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce. ...
2
votes
1answer
993 views

Repeated NONCE in CTR mode

My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
4
votes
1answer
326 views

Using the Unix epoch as nonce

Since a nonce must be unique and that time only goes forward, is it safe to use the Unix epoch as nonce ? My use case is be AES w/ GCM which recommends a nonce length of 12B. Current Unix time can be ...
6
votes
1answer
1k views

Nonce for AES GCM to prevent replay attacks

I am wanting to encrypt a message with a pre shared key that uses AES GCM from the OpenSSL library to do so. I generate my key for the AES crypto via hashing my pre shared key with a salt using the <...
4
votes
1answer
350 views

What is the LENGTH parameter in EEA2?

In the EEA2 option for encryption in LTE the AES-128 algorithm is mechanized. There, the nonce used in the CTR Mode is a 128-bit value. The first 64-bits are covered by a COUNTER, a BEARER, a ...
8
votes
1answer
339 views

Is the 'nonce' in bitcoin really a nonce?

Is the 'nonce' in bitcoin really a nonce? Reading definitions of nonce and salt it seems the number is used as a salt but the same value can occur in multiple blocks; there's no requirement or indeed ...
4
votes
1answer
485 views

Using AES-CTR to generate AES subkeys from a master key and nonce

Suppose I would like to encrypt some data using AES-GCM because it has hardware support on my processor and it is secure. Unfortunately, I don't like the 96-bit nonce size, because I want to randomly ...
4
votes
2answers
335 views

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? My reasoning is as follows: the Rumba compression function allows attackers to supply any 48-byte input to ...
3
votes
1answer
703 views

Is it acceptable to write the nonce to the encrypted file during AES-256 GCM? [duplicate]

I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm ...