Questions tagged [nonce]
A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.
198
questions
0
votes
1
answer
37
views
How do bad actors manipulate game results in real time within 'provably fair' gaming systems?
Ive been assigned research involving online gaming companies and their use of cryptographic algorithms to produce 'provably fair' results. The largest player in the industry uses a method involving a ...
1
vote
0
answers
25
views
Where do we put known bits of nonce when performing lattice attack on ECDSA?
I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB.
So here i am trying to ...
0
votes
1
answer
57
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 101
2
votes
1
answer
139
views
AES GCM iv/nonce length under 12 bytes in java [duplicate]
I'm developping an Swift app that communicate with a Java legacy backend using AES GCM, my biggest problem is that Java let you use a 8 bytes iv/nonce (and the legacy code is written with 8 bytes ...
2
votes
1
answer
145
views
48-bit nonce reuse with ChaCha20
The situation:
I have a group with 20 members, each member broadcasting 1 message per second. Communicating one on one is possible, but 1 message per member per second is the absolute limit and every ...
- 43
2
votes
1
answer
258
views
Does RFC 6979 unconditionally prevent nonce-reuse attacks?
Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
- 3,645
6
votes
1
answer
143
views
What's the current status of development of hedged ECDSA and EdDSA?
In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use ...
- 9,001
2
votes
1
answer
347
views
NaCL - should I keep track of expired nonces
I store the ciphertext and the nonce in a SQL database.
If I decrypt the ciphertext change it and encrypt it again I generate a new nonce, so that I do not encrypt two different plaintexts with the ...
user109145
0
votes
0
answers
66
views
Why using linear increasing nonce in DSA in a bad idea?
Suppose we sign and verify messages with a DSA scheme. Before signing the first
message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
- 1
2
votes
1
answer
64
views
Choice of nonce for reproducible encryption
In my application I have an SQLite database that stores labels for images, like this:
IMAGE ID
LABEL
1
foo
1
bar
2
bar
3
foo
The LABEL column is indexed as it is important that I can efficiently ...
- 173
1
vote
1
answer
78
views
In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?
Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation.
Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
- 391
2
votes
1
answer
163
views
What degree of k bias is acceptable in ECDSA?
So there’s LadderLeak.
RFC6979 produces uniformly random nonce $k$.
There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
- 340
4
votes
1
answer
244
views
Why do nonce misuse resistant schemes mac the plaintext?
Choosing a proper nonce is a vital part of every symmetric-key encrypted communication, and it is mandatory that every encrypted message has a unique nonce. It can be shown that using a nonce twice ...
- 201
1
vote
0
answers
127
views
Probability of getting a collision using chosen plaintext attacks
For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA.
Question:
I have attempted to answer part 3, but am not very confident in the ...
- 77
0
votes
1
answer
98
views
Can attacker create encryption of message m XOR 1^n given the ciphertext c, in nonce-based counter mode?
The following question is from Stanford cryptography course final exam paper.
Suppose an attacker intercepts a ciphertext c which is the encryption of a message m ε {0, 1}^n under nonce-based counter ...
2
votes
1
answer
753
views
Chosen Plain text attack [closed]
I have a course work for university, the question is:
Consider a symmetric encryption scheme with its encryption operation written as
$$C = E(K, R||P)$$
where $E$ is a block cipher encryption ...
- 77
1
vote
1
answer
124
views
Block cipher decryption
I have a course work for university.
The question is:
My solution to the question is:
P||R = D(K,C)
However, in the question it doesn't say we are given R so ...
- 77
1
vote
0
answers
124
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
1
vote
2
answers
1k
views
Recovering nonce in ECDSA with known shared components in ECDSA
This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces.
Given a random $k$:
$$
k_1 = ka,
k_2 = kb
$$
I am now signing two messages, which ...
- 111
0
votes
1
answer
69
views
MOSH - Decrypt session when the shared secret is known
Currently I'm working on an intercepting proxy server for mosh connections.
I'm able to intercept the ssh session to get the shared secret and alter the connection information for the mosh client. The ...
- 101
0
votes
1
answer
49
views
How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers
Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which:
should be used like passwords(known only by few individuals)
must always be the same for the same ...
- 111
12
votes
3
answers
5k
views
How much security is gained from hiding the nonce?
Public nonces can be problematic for privacy when they can be considered metadata. They can also be troublesome for security if you do things like using a hash of the message as the nonce.
PASETO now ...
- 1,587
2
votes
1
answer
148
views
Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?
In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
2
votes
1
answer
609
views
Breaking ecdsa with biased nonce
I'm trying to do this cryptopals challenge for breaking ecdsa with biased nonce but everything I do fail to work. I'm trying my attack with 4 signatures and 128 bit bias.
...
- 53
3
votes
1
answer
175
views
AES-GCM with different IVs but close enough for counter to cause duplicates
I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
- 33
3
votes
1
answer
264
views
I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2
As per my understanding that the nonce of AES-GCM in SSL has 3 parts:
. salt, 4 bytes, generated in handshake, not changed in whole session
. nonce_explicit, 8 bytes, chosen by the sender and ...
- 49
0
votes
0
answers
590
views
How to use nonces to prevent replay attacks while enabling concurrent requests?
Nonces are often used to prevent replay attacks in networks. Because they are a one time use, any attacker replaying a request would be stopped because the nonce would be invalid.
However using nonces ...
- 101
0
votes
0
answers
288
views
Nonces in chacha20poly1305 vs chacha20
I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
1
vote
1
answer
198
views
Clarification on nonce collision calculation
I've been working on a AES256-GCM implementation (in Java).
I'm a little bit stuck on the part where i need to decide how often i need to rotate my key.
I've got a lot of information from this posts:
...
- 13
0
votes
1
answer
173
views
Protection (nonce addition?) against key discovery in AES 256
I've got a situation where I need to send message ciphered with AES-256. However the content, and therefore length, of the message may be intercepted before (don't ask;)) and the question I was asked ...
1
vote
2
answers
214
views
Encrypting with nonces in IKE
In IKE exchanges, first messages sent unencrypted and unauthenticated. For authentication, messages sent encrypted with nonces.
If a man in the middle is eavesdropping this conversation, he/she will ...
- 27
2
votes
1
answer
701
views
Is it possible to brute-force the nonce used in ECDSA?
It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
- 123
0
votes
1
answer
1k
views
Help breaking ECDSA with biased nonces
I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
- 186
0
votes
1
answer
488
views
Is it possible to generate ECDSA signature without nonce?
I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
- 1
2
votes
0
answers
746
views
Why does OAuth 1.0a require random nonces and how random should they be?
What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put.
The ...
- 159
2
votes
0
answers
465
views
Short Nonces in ECDSA signature generation
Recently I noticed that my device generates short-sized Nonces.
Approximately $2 ^ {243} - 2^{244}$.
Could it turn out that there will be a small leak of ...
1
vote
1
answer
861
views
Signing same message 2 times with ECDSA
Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?
- 11
2
votes
2
answers
1k
views
Is it insecure to make nonce using random number generator and hashing algorythm with secret key like HMAC?
I'm building a project on Arduino Mega microcontroller and I need some nonce generator for challenge-response exchange. But I failed to find some alphanumerical string generators. Then I came up with ...
- 143
1
vote
1
answer
103
views
Can a nonce be completely random on (simplified) Needham–Schroeder Protocol?
From what I've read so far, nonces are random one-time values, which are sent in plaintext in addition to the ciphertext to verify identity of sender/receiver. Theoretically, if the nonce is random, ...
- 13
1
vote
1
answer
482
views
Incrementing nonces vs regular nonces?
I have recently been studying up on the lorawan protocol for IoT devices.
LoraWAN has a handshake, and then communication can commense. Messages are encrypted and MAC'ed. When encryption and MAC's are ...
1
vote
0
answers
39
views
How safe is store nonce with encrypted text? [duplicate]
I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
- 11
1
vote
1
answer
1k
views
How to use nonce, counter, and IV in AES-256-CTR?
preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need.
how do i construct a valid IV, given a nonce? What does this have to do ...
- 11
1
vote
0
answers
257
views
Implement deterministic authenticated encryption using libsodium
Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly
Context
I'm willing to create a git encryption tool (...
- 11
1
vote
1
answer
970
views
Is it safe to use many nonces for XChaCha20?
I have a very simple question. Since XChaCha20 nonces are 192-bit, there's technically no limitation to the max number of message encrypted, since the chances of two random nonces being the same are ...
- 421
1
vote
2
answers
192
views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
- 77
0
votes
0
answers
94
views
How Mac-then-encrypt provide security in nonce-misuse setting?
From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
- 2,074
1
vote
0
answers
210
views
Forgery of the Carter-Wegman MAC
Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
- 41
0
votes
0
answers
90
views
Best way to derive a MAC key without a salt
It's best to use separate keys for encryption and the MAC.
Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96).
Alternatively, you can ...
- 1
3
votes
1
answer
128
views
What are the implications of allowing a zero-length GCM nonce?
NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
- 1,704
2
votes
2
answers
357
views
Can I use ChaCha20-Poly1305 as my KDF?
I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
