2022 Developer Survey is open! Take survey.

Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

Filter by
Sorted by
Tagged with
0 votes
0 answers
39 views

Nonces in chacha20poly1305 vs chacha20

I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
user avatar
1 vote
1 answer
41 views

Clarification on nonce collision calculation

I've been working on a AES256-GCM implementation (in Java). I'm a little bit stuck on the part where i need to decide how often i need to rotate my key. I've got a lot of information from this posts: ...
user avatar
0 votes
0 answers
33 views

Does random IVs in CTR block cipher mode combined with XOR allow to encrypt number of blocks up to the same numeric count of IV?

I read about CTR block cipher mode in Wikipedia: "If the IV/nonce is random, then they can be combined with the counter using any invertible operation (concatenation, addition, or XOR) to produce ...
user avatar
0 votes
1 answer
73 views

Protection (nonce addition?) against key discovery in AES 256

I've got a situation where I need to send message ciphered with AES-256. However the content, and therefore length, of the message may be intercepted before (don't ask;)) and the question I was asked ...
user avatar
1 vote
2 answers
30 views

Encrypting with nonces in IKE

In IKE exchanges, first messages sent unencrypted and unauthenticated. For authentication, messages sent encrypted with nonces. If a man in the middle is eavesdropping this conversation, he/she will ...
user avatar
  • 27
2 votes
1 answer
138 views

Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
user avatar
0 votes
1 answer
215 views

Help breaking ECDSA with biased nonces

I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
user avatar
0 votes
1 answer
114 views

Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
user avatar
  • 1
2 votes
0 answers
52 views

Why does OAuth 1.0a require random nonces and how random should they be?

What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put. The ...
user avatar
  • 159
2 votes
0 answers
98 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
user avatar
1 vote
1 answer
208 views

Signing same message 2 times with ECDSA

Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?
user avatar
2 votes
2 answers
151 views

Is it insecure to make nonce using random number generator and hashing algorythm with secret key like HMAC?

I'm building a project on Arduino Mega microcontroller and I need some nonce generator for challenge-response exchange. But I failed to find some alphanumerical string generators. Then I came up with ...
user avatar
  • 143
1 vote
1 answer
49 views

Can a nonce be completely random on (simplified) Needham–Schroeder Protocol?

From what I've read so far, nonces are random one-time values, which are sent in plaintext in addition to the ciphertext to verify identity of sender/receiver. Theoretically, if the nonce is random, ...
user avatar
1 vote
1 answer
109 views

Incrementing nonces vs regular nonces?

I have recently been studying up on the lorawan protocol for IoT devices. LoraWAN has a handshake, and then communication can commense. Messages are encrypted and MAC'ed. When encryption and MAC's are ...
user avatar
1 vote
0 answers
31 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
user avatar
0 votes
1 answer
402 views

How to use nonce, counter, and IV in AES-256-CTR?

preface: i am not cryptographically savvy. there are similar questions on this board but they do not give the answer i need. how do i construct a valid IV, given a nonce? What does this have to do ...
user avatar
1 vote
0 answers
91 views

Implement deterministic authenticated encryption using libsodium

Note: this is my first question on stack exchange, let me know if you miss some details to answer and I will edit the question accordingly Context I'm willing to create a git encryption tool (...
user avatar
  • 11
1 vote
1 answer
629 views

Is it safe to use many nonces for XChaCha20?

I have a very simple question. Since XChaCha20 nonces are 192-bit, there's technically no limitation to the max number of message encrypted, since the chances of two random nonces being the same are ...
user avatar
  • 421
1 vote
2 answers
98 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
user avatar
0 votes
0 answers
55 views

How Mac-then-encrypt provide security in nonce-misuse setting?

From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
user avatar
  • 1,980
1 vote
0 answers
118 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
user avatar
0 votes
0 answers
65 views

Best way to derive a MAC key without a salt

It's best to use separate keys for encryption and the MAC. Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96). Alternatively, you can ...
user avatar
  • 1
3 votes
1 answer
78 views

What are the implications of allowing a zero-length GCM nonce?

NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
user avatar
  • 1,664
2 votes
2 answers
215 views

Can I use ChaCha20-Poly1305 as my KDF?

I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
user avatar
2 votes
1 answer
315 views

AES256 CTR nonce generation

I am following a wiki diagram for CTR mode of operation in AES256. The documentation states that for it to work you need a random nonce with 8 bytes and then a counter of 8 bytes. So I guess you can ...
user avatar
0 votes
1 answer
51 views

Can a nonce be used to steganographically hide a message?

If a standard encryption scheme involves a nonce, as most do, can the nonce be used to hide another small message? That is, the nonce (rather than being randomly generated) is a hidden message XORed ...
user avatar
  • 1,423
1 vote
2 answers
954 views

Encrypt a big file in blocks with AES-GCM: how many nonce do we need?

I need to encrypt big files using AES-GCM, potentially 10 GB or more. For memory (RAM) reasons, I need to processs them by blocks (let's say 16 MB), rather than doing ...
user avatar
  • 481
1 vote
1 answer
259 views

Can we encrypt part of the XChaCha/XSalsa nonce?

The xChaCha cipher detailed here extends the nonce 192bits and works as follows (from the link): Pass the key and the first 16 bytes of the 24-byte nonce to HChaCha20 to obtain the subkey. Use the ...
user avatar
  • 1,423
1 vote
1 answer
215 views

Using a nonce as a salt for key derivation

I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case ...
user avatar
0 votes
0 answers
170 views

Which of the following is/are true about nonces/timestamps?

a. A nonce may or may not be predictable. b. Use of timestamps requires fewer numbers of messages compared to nonce-only authentication protocols. c. Server keeps track of nonce it has used in the ...
user avatar
0 votes
1 answer
150 views

Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...
user avatar
  • 3
1 vote
1 answer
95 views

What is encrypted with the key to give the keystream in CTR mode exactly?

I'm learning how CTR mode and there is something I have trouble understanding. If I understood correctly, two components are encrypted with the key, a nonce and a counter concatenated, and it looks ...
user avatar
3 votes
0 answers
89 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
user avatar
  • 235
9 votes
0 answers
170 views

Are there any weak nonce-misuse resistant encryption scheme?

Nonce-misuse resistance seems to have two standard notions: The stronger notion: this reveals nothing unless the exact same nonce is used to encrypt the exact same message twice. In this case, the ...
user avatar
  • 43.1k
0 votes
0 answers
185 views

Authentication using a nonce

For an authentication problem imagine the following scenario with two devices: 1 server 1 client. The client starts a conversation with the server and sends him his public key. All public keys in ...
user avatar
2 votes
1 answer
492 views

Why is it secure to reuse key and nonce in ChaCha20-Poly1305 AEAD construction?

While looking at the ChaCha20 and Poly1305 AEAD construction as defined by RFC 8439, more precisely its use of the key and the nonce, I came up with the questions below. Maybe someone with some in-...
user avatar
1 vote
1 answer
44 views

What should an identifer in the client-server model?

I am fairly new to cryptography and I am trying to understand this picture here. I have some questions regarding this picture. What should be an identifer for a side? For example, in the picture, it ...
user avatar
3 votes
1 answer
195 views

Is there an increased risk of nonce reuse when using GCM with a nonce more than 96 bits?

GCM is designed to use a 96-bit nonce, which can be generated either randomly or deterministically. If you use a nonce that isn't 96 bits then it is padded and hashed with GHASH to create a ...
user avatar
0 votes
0 answers
89 views

salsa20 (Key, Nonce) repeatable?

in Salsa20, the Key is 128 or 256 bits, the Nonce is 64 bits. the pair (k,r) should never be reused. Does it means, if the key is fixed, the encryption can only run 2^64 times? if the key is not fixed,...
user avatar
1 vote
1 answer
119 views

Nonce of AES-GCM generated by Counters

i am trying to generate the nonce for AES-GCM. I know people usually generate it by Counters and LFSRs. I am confused about the meaning of Counters. Is that means Counter (CTR)? Why it can generate ...
user avatar
1 vote
2 answers
845 views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
user avatar
  • 75
2 votes
1 answer
538 views

Is it safe to reuse the same nonce for decryption an indefinite amount of times in this context?

I'm creating a password management application and I'm considering using the following procedure to keep passwords safe: Asking the user for raw_password, for ...
user avatar
  • 407
2 votes
1 answer
156 views

If ChaCha20 is being used just as a CSPRNG, is nonce needed?

I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the ...
user avatar
4 votes
2 answers
1k views

Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?

I'd expect a 192-bit nonce derived from a 256-bit nonce by computing the SHA-256 hash and then truncating it to 24 bytes to behave like an approximately uniformly randomly generated 192-bit nonce and ...
user avatar
3 votes
2 answers
658 views

Size of IV in AES-GCM according to RFC 4106

RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is ...
user avatar
1 vote
1 answer
1k views

How to generate a nonce for ChaCha20 Poly1305?

I am using a self implementation of ChaCha20 with Poly1305. Since the nonce is only 96 bits it cannot be chosen at random. Can anyone suggest an efficient method to generate nonce from the key ?
user avatar
1 vote
2 answers
3k views

What is the use of a nonce in public-key encryption if it's meant to be shared?

I'm using PHP. The guys over at paragonie have made encryption easy for the PHP eco-system. Now, on my computer, Alice, when I ...
user avatar
2 votes
1 answer
318 views

ChaCha20-Poly1305: Can my salt/pass for a KDF also be the nonce?

I have a PSK. I don't want to use it directly. I want to pass a "salt"/password into a KDF and get a new key for authenticated encryption with ChaCha20-Poly1305 . I need to give the other side the ...
user avatar
-1 votes
1 answer
191 views

How to implement nonce for hashing a 6 digit sensitive number with hmac with its secret key

I have to pass a 6 digit number which has to be kept very secret through a unsecured netwok. I am thinking to hash it using hmac and a secret key which only me and the reciever knows So the code ...
user avatar
  • 113
1 vote
0 answers
151 views

Break an encryption made with XOR of a key and a known Nonce

My questions is general, but in my case regards the Kerberos protocol and the communication between the client first message and the KDC. Is there some problem in encrypting using a: (secret key XOR ...
user avatar