The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

Filter by
Sorted by
Tagged with
1
vote
1answer
48 views

Authenticated Encryption mode & AEAD

I'm studying Authenticated encryption with Associated Data (AEAD). My questions are About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
0
votes
1answer
24 views

XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt

Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay ...
0
votes
1answer
37 views

Using same key and nonce for different field of the same document

I have some fields, similar to NAME, SURNAME, EMAIL, ADDRESS... I'm using NaCl for symmetric encryption. Is bad If I Encrypt every field with the same key and nonce? They are encrypted and stored ...
0
votes
1answer
52 views

AES CCM replay attack and nonce

My wireless sensor nodes and gateway application use timestamps as nonce and will guaranty that different messages use different nonces so security is not compromised. If for some reason the gateway ...
1
vote
1answer
116 views

ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

Note: I realize in ChaCha20 the nonce should be random and unique each time follow certain constraints but am trying to determine whether there could be a safe way to use it just once if other ...
1
vote
1answer
310 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
1
vote
0answers
42 views

Why does 3-way authentication need the 3rd nonce to be stored?

In the following 3-way authentication protocol: A -> B: $N_a$ || B || Signature_KprivA B -> A: $N_a+1$ || $N_b$ || A || Signature_KprivB A -> B: $N_b+1$ || Signature_KprivA ($N_a$ and $N_b$ are ...
3
votes
3answers
224 views

How to prevent accidental nonce reuse with AEAD cipher

I'm trying to correctly implement ChaCha20-Poly1305 in my node.js app (...crypto is hard). I understand that the cipher requires a unique key/nonce pair for each message or the security breaks down. ...
0
votes
0answers
73 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
0
votes
1answer
113 views

Why Nonces and timestamps are used in Public key authority?

why the nonces(N1 and N2) and Timestamps(T1 and T2) are used in Public key Authority? which of them prevent replay attack?
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
2
votes
1answer
179 views

Timestamps, sequence numbers, and nonces for replay attack

What are the best practices or standardized methods to prevent replay attacks in a simple server client setup (preferably where the server is stateless) ? When should timestamps, sequence numbers, ...
4
votes
1answer
760 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
0
votes
2answers
235 views

What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
1
vote
1answer
243 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
6
votes
1answer
377 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
1
vote
0answers
138 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
0
votes
1answer
118 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
1
vote
2answers
744 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
1
vote
0answers
63 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
6
votes
3answers
2k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
5
votes
1answer
299 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
3
votes
1answer
213 views

Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant? I'm thinking of something like the following AEAD-like scheme: ...
0
votes
1answer
101 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
-4
votes
1answer
90 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
3
votes
1answer
222 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
74 views

What happens when a nonce is reused (WPA2)

I am trying to understand the KRACK on WPA2. But in their paper (PDF) it just simply states that By forcing nonce reuse in this manner, the encryption protocol can be attacked. But I cannot find ...
1
vote
1answer
278 views

regarding nonce and secret key

Consider the following challenge-response protocol for $A$ to convince $B$ that he is indeed $A$. Here we are assuming: at the start when the virtual circuit is being set up, $A$ has to convince $B$ ...
4
votes
1answer
1k views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
1
vote
1answer
186 views

How used nonce in CTR Mode of AES-EAX Encryption?

I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
1
vote
1answer
255 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...
1
vote
0answers
153 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
7
votes
1answer
1k views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
3
votes
1answer
1k views

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
2
votes
2answers
586 views

Can One-time-password be used as nonce in HMAC to prevent replay?

Note: In the following post OTP = one-time-password I am working on a project wherein I need send one way messages between two end points. There is already a shared secret via a side channel between ...
1
vote
1answer
2k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
1
vote
1answer
634 views

How to find the secret key and nonce from two messages encrypted using the same nonce?

As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken. If I use NaCl's crypto_box http://nacl.cr.yp.to/...
4
votes
1answer
269 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
8
votes
3answers
555 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
-1
votes
1answer
207 views

Why using a nonce not more than once in SSL/TLS [duplicate]

Why it is highly recommended to use a nonce once and only once in SSL/TLS? Same question with key streams in stream ciphers? What sort of attack(s) could take place if ever a nonce/key stream is used ...
8
votes
1answer
244 views

Difference between Tweak and nonce

What are diffrences between tweak and nonce? I only know that nonce is used only once but tweak can be used for more than one time.but still by this diffrence I can't diffrentiate tweak and nonce
6
votes
1answer
324 views

Why does SpongeWrap not need a Nonce?

The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined. What is ...
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
3
votes
1answer
130 views

What is a nonce-respecting adversary?

The NORX8 paper says It is assumed that adversaries are nonce-respecting. What is a nonce-respecting adversary?
4
votes
1answer
420 views

Nonce reuse resistance

I read this article and I think the approach outlined there is very interesting for one of our use case. We use ChaCha20 Poly1305 (via Sodium ...
8
votes
2answers
828 views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
3
votes
1answer
399 views

Why is a nonce used to initialize Hash_DRBG, HMAC_DRBG, and CTR_DRBG?

In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation. I understand the usual application for a nonce to prevent replay attacks. However,...
1
vote
0answers
873 views

ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal: $$ Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
5
votes
2answers
346 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
7
votes
1answer
254 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...