Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nonce]

A "nonce" is an arbitrary number or string used only once within the context of a specific cryptographic scheme. Nonces are used e.g. in authentication protocols to prevent replay attacks, as well as in stream ciphers (including CTR mode) to avoid keystream reuse.

0
votes
1answer
53 views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
1
vote
0answers
39 views

Why does 3-way authentication need the 3rd nonce to be stored?

In the following 3-way authentication protocol: A -> B: $N_a$ || B || Signature_KprivA B -> A: $N_a+1$ || $N_b$ || A || Signature_KprivB A -> B: $N_b+1$ || Signature_KprivA ($N_a$ and $N_b$ are ...
3
votes
3answers
155 views

How to prevent accidental nonce reuse with AEAD cipher

I'm trying to correctly implement ChaCha20-Poly1305 in my node.js app (...crypto is hard). I understand that the cipher requires a unique key/nonce pair for each message or the security breaks down. ...
0
votes
0answers
66 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
0
votes
1answer
77 views

Why Nonces and timestamps are used in Public key authority?

why the nonces(N1 and N2) and Timestamps(T1 and T2) are used in Public key Authority? which of them prevent replay attack?
8
votes
3answers
1k views

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
2
votes
1answer
83 views

Timestamps, sequence numbers, and nonces for replay attack

What are the best practices or standardized methods to prevent replay attacks in a simple server client setup (preferably where the server is stateless) ? When should timestamps, sequence numbers, ...
4
votes
1answer
724 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
0
votes
2answers
193 views

What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
1
vote
1answer
143 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
5
votes
1answer
272 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
1
vote
0answers
91 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
0
votes
1answer
91 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
1
vote
2answers
618 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
1
vote
0answers
56 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
6
votes
3answers
2k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
4
votes
1answer
211 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
2
votes
1answer
197 views

Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant? I'm thinking of something like the following AEAD-like scheme: ...
0
votes
1answer
84 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
-4
votes
1answer
89 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
3
votes
1answer
212 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
68 views

What happens when a nonce is reused (WPA2)

I am trying to understand the KRACK on WPA2. But in their paper (PDF) it just simply states that By forcing nonce reuse in this manner, the encryption protocol can be attacked. But I cannot find ...
1
vote
1answer
241 views

regarding nonce and secret key

Consider the following challenge-response protocol for $A$ to convince $B$ that he is indeed $A$. Here we are assuming: at the start when the virtual circuit is being set up, $A$ has to convince $B$ ...
4
votes
1answer
980 views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
1
vote
1answer
162 views

How used nonce in CTR Mode of AES-EAX Encryption?

I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
1
vote
1answer
230 views

Is the nonce in GCM mode used as key for HMAC? And how to send it?

So, my believe is that, in some way, GCM mode or any other authenticated encryption mode is useful to provide encryption and integrity for the ciphertext altogether instead of having to handle the ...
1
vote
0answers
137 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
7
votes
1answer
967 views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
3
votes
1answer
1k views

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

Problem: want to encrypt messages/objects/files using AES-GCM with the same secret key in a safe way, but want to do it in distributed/stateless way, so the IV of previous encryptions with the same ...
2
votes
2answers
512 views

Can One-time-password be used as nonce in HMAC to prevent replay?

Note: In the following post OTP = one-time-password I am working on a project wherein I need send one way messages between two end points. There is already a shared secret via a side channel between ...
1
vote
1answer
2k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
1
vote
1answer
527 views

How to find the secret key and nonce from two messages encrypted using the same nonce?

As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken. If I use NaCl's crypto_box http://nacl.cr.yp.to/...
4
votes
1answer
251 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
8
votes
3answers
497 views

Why does TLS 1.3 use random-looking nonces for AEAD?

In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-...
-1
votes
1answer
181 views

Why using a nonce not more than once in SSL/TLS [duplicate]

Why it is highly recommended to use a nonce once and only once in SSL/TLS? Same question with key streams in stream ciphers? What sort of attack(s) could take place if ever a nonce/key stream is used ...
8
votes
1answer
220 views

Difference between Tweak and nonce

What are diffrences between tweak and nonce? I only know that nonce is used only once but tweak can be used for more than one time.but still by this diffrence I can't diffrentiate tweak and nonce
6
votes
1answer
313 views

Why does SpongeWrap not need a Nonce?

The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined. What is ...
8
votes
2answers
946 views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
3
votes
1answer
117 views

What is a nonce-respecting adversary?

The NORX8 paper says It is assumed that adversaries are nonce-respecting. What is a nonce-respecting adversary?
4
votes
1answer
390 views

Nonce reuse resistance

I read this article and I think the approach outlined there is very interesting for one of our use case. We use ChaCha20 Poly1305 (via Sodium ...
6
votes
2answers
763 views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
3
votes
1answer
364 views

Why is a nonce used to initialize Hash_DRBG, HMAC_DRBG, and CTR_DRBG?

In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation. I understand the usual application for a nonce to prevent replay attacks. However,...
1
vote
0answers
807 views

ElGamal: Why is reusing the same $k$ not secure?

I have a question on the encryption process of ElGamal: $$ Y = g ^ a \bmod p \\ C = g ^ k \bmod p \quad\text{($k$ is chosen randomly)} \\ D = m \cdot y ^ k \bmod p \\ \text{Decryption:}\...
5
votes
2answers
329 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
7
votes
1answer
246 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
1
vote
1answer
266 views

Reuse nonce with Salsa20 stream cipher with counter

It is often said to never use a nonce for more than one message when using a stream cipher. It seems this is to prevent something like this: Taking advantage of one-time pad key reuse? Yet what if I ...
4
votes
1answer
468 views

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

I design encryption for a network protocol with restrictively low MTU. I'm aiming at 128 bit strength; AES-128-CCM would add 128 nonce bits and 128 MAC bits to each packet. Such MTU reduction by 32 ...
1
vote
0answers
141 views

How to produce a message digest?

I've been trying this problem: Use the prototype function to hash message bit string into a length 16 message digest. Append (at the right end) the shortest nonce to the string (the spaces are ...
1
vote
1answer
69 views

As a cryptographic primitive, what does a nonce provide?

As a cryptographic primitive, what does a nonce provide? It seems like, at least in my understanding of it, a nonce by itself would not provide any sort of cryptographic usefulness, compared with ...
4
votes
1answer
3k views

What advantage is there for using a nonce and a timestamp?

I know both nonces and timestamps are used to prevent replay attacks, and nonces may offer increased security in the situation a message could be replayed with the timestamp in the allowable window. ...