Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

Filter by
Sorted by
Tagged with
5 votes
2 answers
486 views

CVE-2024-31497, nonces and random numbers: Can someone explain, please? [closed]

Regarding CVE-2024-31497 a German article "Nur NIST P-521 betroffen: PuTTY-Lücke kompromittiert private SSH-Schlüssel" wrote something about a vulnerability in PuTTY. The issue was claimed ...
U. Windl's user avatar
  • 229
0 votes
1 answer
239 views

Encrypting the nonce in AES-CCM

I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
byte-carlton's user avatar
0 votes
0 answers
67 views

Exposing the vulnerability of CTR mode of operation

In the CTR mode of operation, the plaintext block is treated as a stream cipher, where each byte of the plaintext gets XOR-ed with each byte of the key (which is generated using a nonce and a counter) ...
Abhinav Tahlani's user avatar
0 votes
1 answer
44 views

JavaScript PKCE Code Verifier (random string nonce) alternatives

I'm creating a PKCE Code Verifier (a random string). Solution 1 from a StackOverflow answer. (You can copy/paste these code examples into a browser's inspector.) ...
Larry K's user avatar
  • 103
0 votes
1 answer
237 views

How do bad actors manipulate game results in real time within 'provably fair' gaming systems?

Ive been assigned research involving online gaming companies and their use of cryptographic algorithms to produce 'provably fair' results. The largest player in the industry uses a method involving a ...
Joey Jolly's user avatar
1 vote
0 answers
53 views

Where do we put known bits of nonce when performing lattice attack on ECDSA?

I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB. So here i am trying to ...
diviserbyzero's user avatar
0 votes
1 answer
82 views

Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
Julian Durchholz's user avatar
2 votes
1 answer
218 views

AES GCM iv/nonce length under 12 bytes in java [duplicate]

I'm developping an Swift app that communicate with a Java legacy backend using AES GCM, my biggest problem is that Java let you use a 8 bytes iv/nonce (and the legacy code is written with 8 bytes ...
Pierre Berget's user avatar
2 votes
1 answer
184 views

48-bit nonce reuse with ChaCha20

The situation: I have a group with 20 members, each member broadcasting 1 message per second. Communicating one on one is possible, but 1 message per member per second is the absolute limit and every ...
Florebol's user avatar
2 votes
1 answer
267 views

Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
Melab's user avatar
  • 3,655
6 votes
1 answer
186 views

What's the current status of development of hedged ECDSA and EdDSA?

In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use ...
DannyNiu's user avatar
  • 9,216
2 votes
1 answer
410 views

NaCL - should I keep track of expired nonces

I store the ciphertext and the nonce in a SQL database. If I decrypt the ciphertext change it and encrypt it again I generate a new nonce, so that I do not encrypt two different plaintexts with the ...
user avatar
0 votes
0 answers
79 views

Why using linear increasing nonce in DSA in a bad idea?

Suppose we sign and verify messages with a DSA scheme. Before signing the first message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
rL0sr's user avatar
  • 1
2 votes
1 answer
71 views

Choice of nonce for reproducible encryption

In my application I have an SQLite database that stores labels for images, like this: IMAGE ID LABEL 1 foo 1 bar 2 bar 3 foo The LABEL column is indexed as it is important that I can efficiently ...
AndreKR's user avatar
  • 173
1 vote
1 answer
94 views

In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?

Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation. Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
alpominth's user avatar
  • 393
2 votes
1 answer
190 views

What degree of k bias is acceptable in ECDSA?

So there’s LadderLeak. RFC6979 produces uniformly random nonce $k$. There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
Paul Miller's user avatar
4 votes
1 answer
268 views

Why do nonce misuse resistant schemes mac the plaintext?

Choosing a proper nonce is a vital part of every symmetric-key encrypted communication, and it is mandatory that every encrypted message has a unique nonce. It can be shown that using a nonce twice ...
polfosol's user avatar
  • 201
1 vote
0 answers
146 views

Probability of getting a collision using chosen plaintext attacks

For university I am doing a piece of coursework right now. This question is focusing on CPA and collisions using CPA. Question: I have attempted to answer part 3, but am not very confident in the ...
hasin's user avatar
  • 77
0 votes
1 answer
117 views

Can attacker create encryption of message m XOR 1^n given the ciphertext c, in nonce-based counter mode?

The following question is from Stanford cryptography course final exam paper. Suppose an attacker intercepts a ciphertext $c$ which is the encryption of a message $m\in\{0,1\}^n$ under nonce-based ...
Knightoforous's user avatar
2 votes
1 answer
855 views

Chosen Plain text attack [closed]

I have a course work for university, the question is: Consider a symmetric encryption scheme with its encryption operation written as $$C = E(K, R||P)$$ where $E$ is a block cipher encryption ...
hasin's user avatar
  • 77
1 vote
1 answer
126 views

Block cipher decryption

I have a course work for university. The question is: My solution to the question is: P||R = D(K,C) However, in the question it doesn't say we are given R so ...
hasin's user avatar
  • 77
1 vote
0 answers
144 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
1 vote
2 answers
1k views

Recovering nonce in ECDSA with known shared components in ECDSA

This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces. Given a random $k$: $$ k_1 = ka, k_2 = kb $$ I am now signing two messages, which ...
kazamatzuri's user avatar
0 votes
1 answer
75 views

MOSH - Decrypt session when the shared secret is known

Currently I'm working on an intercepting proxy server for mosh connections. I'm able to intercept the ssh session to get the shared secret and alter the connection information for the mosh client. The ...
Manfred Kaiser's user avatar
0 votes
1 answer
51 views

How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers

Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which: should be used like passwords(known only by few individuals) must always be the same for the same ...
aschoerk's user avatar
  • 111
12 votes
3 answers
5k views

How much security is gained from hiding the nonce?

Public nonces can be problematic for privacy when they can be considered metadata. They can also be troublesome for security if you do things like using a hash of the message as the nonce. PASETO now ...
samuel-lucas6's user avatar
2 votes
1 answer
164 views

Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
U6aMy0wojraho's user avatar
2 votes
1 answer
713 views

Breaking ecdsa with biased nonce

I'm trying to do this cryptopals challenge for breaking ecdsa with biased nonce but everything I do fail to work. I'm trying my attack with 4 signatures and 128 bit bias. ...
Lordi's user avatar
  • 53
3 votes
1 answer
191 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
Atul Vani's user avatar
3 votes
1 answer
285 views

I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2

As per my understanding that the nonce of AES-GCM in SSL has 3 parts: . salt, 4 bytes, generated in handshake, not changed in whole session . nonce_explicit, 8 bytes, chosen by the sender and ...
prasad's user avatar
  • 49
0 votes
0 answers
681 views

How to use nonces to prevent replay attacks while enabling concurrent requests?

Nonces are often used to prevent replay attacks in networks. Because they are a one time use, any attacker replaying a request would be stopped because the nonce would be invalid. However using nonces ...
CMCDragonkai's user avatar
0 votes
0 answers
374 views

Nonces in chacha20poly1305 vs chacha20

I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
Keegan Conlee's user avatar
1 vote
1 answer
233 views

Clarification on nonce collision calculation

I've been working on a AES256-GCM implementation (in Java). I'm a little bit stuck on the part where i need to decide how often i need to rotate my key. I've got a lot of information from this posts: ...
Paulofski's user avatar
0 votes
1 answer
196 views

Protection (nonce addition?) against key discovery in AES 256

I've got a situation where I need to send message ciphered with AES-256. However the content, and therefore length, of the message may be intercepted before (don't ask;)) and the question I was asked ...
Pączek w maśle's user avatar
1 vote
2 answers
225 views

Encrypting with nonces in IKE

In IKE exchanges, first messages sent unencrypted and unauthenticated. For authentication, messages sent encrypted with nonces. If a man in the middle is eavesdropping this conversation, he/she will ...
hadz's user avatar
  • 27
2 votes
1 answer
805 views

Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
Mr. Engineer's user avatar
0 votes
1 answer
1k views

Help breaking ECDSA with biased nonces

I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
Katoptriss's user avatar
0 votes
1 answer
565 views

Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
guest's user avatar
  • 1
2 votes
0 answers
950 views

Why does OAuth 1.0a require random nonces and how random should they be?

What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put. The ...
gaazkam's user avatar
  • 159
2 votes
0 answers
513 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
Derick Swodnick's user avatar
1 vote
1 answer
940 views

Signing same message 2 times with ECDSA

Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?
Topolino 's user avatar
2 votes
2 answers
1k views

Is it insecure to make nonce using random number generator and hashing algorythm with secret key like HMAC?

I'm building a project on Arduino Mega microcontroller and I need some nonce generator for challenge-response exchange. But I failed to find some alphanumerical string generators. Then I came up with ...
krystof18's user avatar
  • 143
1 vote
1 answer
116 views

Can a nonce be completely random on (simplified) Needham–Schroeder Protocol?

From what I've read so far, nonces are random one-time values, which are sent in plaintext in addition to the ciphertext to verify identity of sender/receiver. Theoretically, if the nonce is random, ...
suigetsuh17's user avatar
1 vote
1 answer
616 views

Incrementing nonces vs regular nonces?

I have recently been studying up on the lorawan protocol for IoT devices. LoraWAN has a handshake, and then communication can commense. Messages are encrypted and MAC'ed. When encryption and MAC's are ...
NotQuiteSo1337's user avatar
1 vote
0 answers
41 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
riwasat604's user avatar
1 vote
1 answer
2k views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
jared chong's user avatar
1 vote
0 answers
280 views

Implement deterministic authenticated encryption using libsodium

Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly Context I'm willing to create a git encryption tool (...
TychoTa's user avatar
  • 11
1 vote
1 answer
1k views

Is it safe to use many nonces for XChaCha20?

I have a very simple question. Since XChaCha20 nonces are 192-bit, there's technically no limitation to the max number of message encrypted, since the chances of two random nonces being the same are ...
Evan Su's user avatar
  • 449
1 vote
2 answers
221 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
augustus's user avatar
0 votes
0 answers
97 views

How Mac-then-encrypt provide security in nonce-misuse setting?

From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
hardyrama's user avatar
  • 2,126

1
2 3 4 5