Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

Filter by
Sorted by
Tagged with
2
votes
2answers
95 views

Why does a nonce prevent a replay attack?

I have a question about a cryptographic nonce. I understand the use of a nonce, however there is one particular part that I don't understand. Please consider the picture below. I don't really ...
0
votes
1answer
44 views

What's the utility of the last two messages of Needham Schroeder Symmetric key protocol

The protocol works like this But I can't understand what's the utility of message 4 and 5, what do they protect from? They do not protect from replay attack if Ks gets compromised because B won't be ...
1
vote
0answers
36 views

Why does a “never-repeating” nonce limit a key to safely encrypt only a single block?

This questions comes from a section outlined in RFC 5297 on SIV-AES. The paragraph in particular outlines the idea of a never repeating nonce vs an "almost always" non-repeating nonce. If the nonce ...
1
vote
1answer
138 views

Chacha20 internal counter/position and nonce

I have to encrypt the communications between two devices. I was planning on using a timestamp(in seconds) and the serial number as the nonce. I know its impossible for me to send more than 100 ...
0
votes
1answer
51 views

Safely store data before moving to air-gapped machine

This is related to an earlier question, Is it possible to use an algorithm to generate an OTP? I have two machines: A, and B. A is connected to the internet and files are uploaded regularly. B is ...
1
vote
1answer
105 views

Authenticated Encryption mode & AEAD

I'm studying Authenticated encryption with Associated Data (AEAD). My questions are About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
0
votes
1answer
42 views

XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt

Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay ...
0
votes
1answer
45 views

Using same key and nonce for different field of the same document

I have some fields, similar to NAME, SURNAME, EMAIL, ADDRESS... I'm using NaCl for symmetric encryption. Is bad If I Encrypt every field with the same key and nonce? They are encrypted and stored ...
0
votes
1answer
88 views

AES CCM replay attack and nonce

My wireless sensor nodes and gateway application use timestamps as nonce and will guaranty that different messages use different nonces so security is not compromised. If for some reason the gateway ...
2
votes
1answer
317 views

ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

Note: I realize in ChaCha20 the nonce should be random and unique each time follow certain constraints but am trying to determine whether there could be a safe way to use it just once if other ...
1
vote
1answer
638 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
1
vote
0answers
42 views

Why does 3-way authentication need the 3rd nonce to be stored?

In the following 3-way authentication protocol: A -> B: $N_a$ || B || Signature_KprivA B -> A: $N_a+1$ || $N_b$ || A || Signature_KprivB A -> B: $N_b+1$ || Signature_KprivA ($N_a$ and $N_b$ are ...
3
votes
3answers
329 views

How to prevent accidental nonce reuse with AEAD cipher

I'm trying to correctly implement ChaCha20-Poly1305 in my node.js app (...crypto is hard). I understand that the cipher requires a unique key/nonce pair for each message or the security breaks down. ...
0
votes
0answers
80 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
0
votes
1answer
192 views

Why Nonces and timestamps are used in Public key authority?

why the nonces(N1 and N2) and Timestamps(T1 and T2) are used in Public key Authority? which of them prevent replay attack?
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
2
votes
1answer
277 views

Timestamps, sequence numbers, and nonces for replay attack

What are the best practices or standardized methods to prevent replay attacks in a simple server client setup (preferably where the server is stateless) ? When should timestamps, sequence numbers, ...
4
votes
1answer
788 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
0
votes
2answers
272 views

What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
1
vote
1answer
316 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
6
votes
1answer
444 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
1
vote
0answers
165 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
0
votes
1answer
147 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
1
vote
2answers
838 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
1
vote
0answers
68 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
6
votes
3answers
2k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
6
votes
1answer
391 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
3
votes
1answer
228 views

Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant? I'm thinking of something like the following AEAD-like scheme: ...
0
votes
1answer
111 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
-4
votes
1answer
91 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
3
votes
1answer
230 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
82 views

What happens when a nonce is reused (WPA2)

I am trying to understand the KRACK on WPA2. But in their paper (PDF) it just simply states that By forcing nonce reuse in this manner, the encryption protocol can be attacked. But I cannot find ...
1
vote
1answer
290 views

regarding nonce and secret key

Consider the following challenge-response protocol for $A$ to convince $B$ that he is indeed $A$. Here we are assuming: at the start when the virtual circuit is being set up, $A$ has to convince $B$ ...
5
votes
1answer
1k views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
1
vote
1answer
200 views

How used nonce in CTR Mode of AES-EAX Encryption?

I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
1
vote
1answer
279 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...
1
vote
0answers
161 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
8
votes
1answer
1k views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
3
votes
1answer
1k views

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
2
votes
2answers
639 views

Can One-time-password be used as nonce in HMAC to prevent replay?

Note: In the following post OTP = one-time-password I am working on a project wherein I need send one way messages between two end points. There is already a shared secret via a side channel between ...
1
vote
1answer
2k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
1
vote
1answer
686 views

How to find the secret key and nonce from two messages encrypted using the same nonce?

As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken. If I use NaCl's crypto_box http://nacl.cr.yp.to/...
4
votes
1answer
282 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
8
votes
3answers
618 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
-1
votes
1answer
218 views

Why using a nonce not more than once in SSL/TLS [duplicate]

Why it is highly recommended to use a nonce once and only once in SSL/TLS? Same question with key streams in stream ciphers? What sort of attack(s) could take place if ever a nonce/key stream is used ...
8
votes
1answer
264 views

Difference between Tweak and nonce

What are diffrences between tweak and nonce? I only know that nonce is used only once but tweak can be used for more than one time.but still by this diffrence I can't diffrentiate tweak and nonce
6
votes
1answer
326 views

Why does SpongeWrap not need a Nonce?

The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined. What is ...
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
3
votes
1answer
146 views

What is a nonce-respecting adversary?

The NORX8 paper says It is assumed that adversaries are nonce-respecting. What is a nonce-respecting adversary?
4
votes
1answer
442 views

Nonce reuse resistance

I read this article and I think the approach outlined there is very interesting for one of our use case. We use ChaCha20 Poly1305 (via Sodium ...