As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

Filter by
Sorted by
Tagged with
6 votes
1 answer
114 views

What's the current status of development of hedged ECDSA and EdDSA?

In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use ...
DannyNiu's user avatar
  • 8,283
2 votes
1 answer
284 views

NaCL - should I keep track of expired nonces

I store the ciphertext and the nonce in a SQL database. If I decrypt the ciphertext change it and encrypt it again I generate a new nonce, so that I do not encrypt two different plaintexts with the ...
Michael's user avatar
  • 23
0 votes
0 answers
47 views

Why using linear increasing nonce in DSA in a bad idea?

Suppose we sign and verify messages with a DSA scheme. Before signing the first message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
rL0sr's user avatar
  • 1
2 votes
1 answer
48 views

Choice of nonce for reproducible encryption

In my application I have an SQLite database that stores labels for images, like this: IMAGE ID LABEL 1 foo 1 bar 2 bar 3 foo The LABEL column is indexed as it is important that I can efficiently ...
AndreKR's user avatar
  • 173
1 vote
1 answer
59 views

In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?

Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation. Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
alpominth's user avatar
  • 181
2 votes
1 answer
117 views

What degree of k bias is acceptable in ECDSA?

So there’s LadderLeak. RFC6979 produces uniformly random nonce $k$. There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
Paul Miller's user avatar
4 votes
1 answer
221 views

Why do nonce misuse resistant schemes mac the plaintext?

Choosing a proper nonce is a vital part of every symmetric-key encrypted communication, and it is mandatory that every encrypted message has a unique nonce. It can be shown that using a nonce twice ...
polfosol's user avatar
  • 201
1 vote
0 answers
88 views

Probability of getting a collision using chosen plaintext attacks

For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA. Question: I have attempted to answer part 3, but am not very confident in the ...
hasin's user avatar
  • 77
0 votes
1 answer
83 views

Can attacker create encryption of message m XOR 1^n given the ciphertext c, in nonce-based counter mode?

The following question is from Stanford cryptography course final exam paper. Suppose an attacker intercepts a ciphertext c which is the encryption of a message m ε {0, 1}^n under nonce-based counter ...
Knightoforous's user avatar
2 votes
1 answer
543 views

Chosen Plain text attack [closed]

I have a course work for university, the question is: Consider a symmetric encryption scheme with its encryption operation written as $$C = E(K, R||P)$$ where $E$ is a block cipher encryption ...
hasin's user avatar
  • 77
1 vote
1 answer
118 views

Block cipher decryption

I have a course work for university. The question is: My solution to the question is: P||R = D(K,C) However, in the question it doesn't say we are given R so ...
hasin's user avatar
  • 77
1 vote
0 answers
82 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
1 vote
2 answers
614 views

Recovering nonce in ECDSA with known shared components in ECDSA

This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces. Given a random $k$: $$ k_1 = ka, k_2 = kb $$ I am now signing two messages, which ...
kazamatzuri's user avatar
0 votes
1 answer
52 views

MOSH - Decrypt session when the shared secret is known

Currently I'm working on an intercepting proxy server for mosh connections. I'm able to intercept the ssh session to get the shared secret and alter the connection information for the mosh client. The ...
Manfred Kaiser's user avatar
0 votes
1 answer
46 views

How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers

Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which: should be used like passwords(known only by few individuals) must always be the same for the same ...
aschoerk's user avatar
  • 111
12 votes
3 answers
5k views

How much security is gained from hiding the nonce?

Public nonces can be problematic for privacy when they can be considered metadata. They can also be troublesome for security if you do things like using a hash of the message as the nonce. PASETO now ...
samuel-lucas6's user avatar
2 votes
1 answer
134 views

Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
U6aMy0wojraho's user avatar
2 votes
1 answer
414 views

Breaking ecdsa with biased nonce

I'm trying to do this cryptopals challenge for breaking ecdsa with biased nonce but everything I do fail to work. I'm trying my attack with 4 signatures and 128 bit bias. ...
Lordi's user avatar
  • 53
3 votes
1 answer
134 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
Atul Vani's user avatar
3 votes
1 answer
238 views

I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2

As per my understanding that the nonce of AES-GCM in SSL has 3 parts: . salt, 4 bytes, generated in handshake, not changed in whole session . nonce_explicit, 8 bytes, chosen by the sender and ...
prasad's user avatar
  • 49
0 votes
0 answers
415 views

How to use nonces to prevent replay attacks while enabling concurrent requests?

Nonces are often used to prevent replay attacks in networks. Because they are a one time use, any attacker replaying a request would be stopped because the nonce would be invalid. However using nonces ...
CMCDragonkai's user avatar
0 votes
0 answers
185 views

Nonces in chacha20poly1305 vs chacha20

I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
Keegan Conlee's user avatar
1 vote
1 answer
141 views

Clarification on nonce collision calculation

I've been working on a AES256-GCM implementation (in Java). I'm a little bit stuck on the part where i need to decide how often i need to rotate my key. I've got a lot of information from this posts: ...
Paulofski's user avatar
0 votes
1 answer
146 views

Protection (nonce addition?) against key discovery in AES 256

I've got a situation where I need to send message ciphered with AES-256. However the content, and therefore length, of the message may be intercepted before (don't ask;)) and the question I was asked ...
Pączek w maśle's user avatar
1 vote
2 answers
160 views

Encrypting with nonces in IKE

In IKE exchanges, first messages sent unencrypted and unauthenticated. For authentication, messages sent encrypted with nonces. If a man in the middle is eavesdropping this conversation, he/she will ...
hadz's user avatar
  • 27
2 votes
1 answer
563 views

Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
Mr. Engineer's user avatar
0 votes
1 answer
814 views

Help breaking ECDSA with biased nonces

I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
Katoptriss's user avatar
0 votes
1 answer
356 views

Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
guest's user avatar
  • 1
2 votes
0 answers
437 views

Why does OAuth 1.0a require random nonces and how random should they be?

What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put. The ...
gaazkam's user avatar
  • 159
2 votes
0 answers
325 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
Derick Swodnick's user avatar
1 vote
1 answer
668 views

Signing same message 2 times with ECDSA

Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?
Topolino 's user avatar
2 votes
2 answers
780 views

Is it insecure to make nonce using random number generator and hashing algorythm with secret key like HMAC?

I'm building a project on Arduino Mega microcontroller and I need some nonce generator for challenge-response exchange. But I failed to find some alphanumerical string generators. Then I came up with ...
krystof18's user avatar
  • 143
1 vote
1 answer
82 views

Can a nonce be completely random on (simplified) Needham–Schroeder Protocol?

From what I've read so far, nonces are random one-time values, which are sent in plaintext in addition to the ciphertext to verify identity of sender/receiver. Theoretically, if the nonce is random, ...
suigetsuh17's user avatar
1 vote
1 answer
359 views

Incrementing nonces vs regular nonces?

I have recently been studying up on the lorawan protocol for IoT devices. LoraWAN has a handshake, and then communication can commense. Messages are encrypted and MAC'ed. When encryption and MAC's are ...
NotQuiteSo1337's user avatar
1 vote
0 answers
36 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
riwasat604's user avatar
1 vote
1 answer
1k views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
jared chong's user avatar
1 vote
0 answers
190 views

Implement deterministic authenticated encryption using libsodium

Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly Context I'm willing to create a git encryption tool (...
TychoTa's user avatar
  • 11
1 vote
1 answer
871 views

Is it safe to use many nonces for XChaCha20?

I have a very simple question. Since XChaCha20 nonces are 192-bit, there's technically no limitation to the max number of message encrypted, since the chances of two random nonces being the same are ...
Evan Su's user avatar
  • 421
1 vote
2 answers
162 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
augustus's user avatar
0 votes
0 answers
85 views

How Mac-then-encrypt provide security in nonce-misuse setting?

From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
hardyrama's user avatar
  • 1,990
1 vote
0 answers
184 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
Sayantan's user avatar
0 votes
0 answers
84 views

Best way to derive a MAC key without a salt

It's best to use separate keys for encryption and the MAC. Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96). Alternatively, you can ...
User's user avatar
  • 1
3 votes
1 answer
113 views

What are the implications of allowing a zero-length GCM nonce?

NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
Jack Lloyd's user avatar
  • 1,694
2 votes
2 answers
311 views

Can I use ChaCha20-Poly1305 as my KDF?

I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
mint branch conditioner's user avatar
2 votes
1 answer
538 views

AES256 CTR nonce generation

I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can ...
znoris007's user avatar
0 votes
1 answer
59 views

Can a nonce be used to steganographically hide a message?

If a standard encryption scheme involves a nonce, as most do, can the nonce be used to hide another small message? That is, the nonce (rather than being randomly generated) is a hidden message XORed ...
Modal Nest's user avatar
  • 1,443
2 votes
2 answers
2k views

Encrypt a big file in blocks with AES-GCM: how many nonce do we need?

I need to encrypt big files using AES-GCM, potentially 10 GB or more. For memory (RAM) reasons, I need to processs them by blocks (let's say 16 MB), rather than doing ...
Basj's user avatar
  • 543
1 vote
1 answer
435 views

Can we encrypt part of the XChaCha/XSalsa nonce?

The xChaCha cipher detailed here extends the nonce 192bits and works as follows (from the link): Pass the key and the first 16 bytes of the 24-byte nonce to HChaCha20 to obtain the subkey. Use the ...
Modal Nest's user avatar
  • 1,443
1 vote
1 answer
400 views

Using a nonce as a salt for key derivation

I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case ...
user69188's user avatar
0 votes
0 answers
206 views

Which of the following is/are true about nonces/timestamps?

a. A nonce may or may not be predictable. b. Use of timestamps requires fewer numbers of messages compared to nonce-only authentication protocols. c. Server keeps track of nonce it has used in the ...
Roshan Kaloni's user avatar