Skip to main content
23 votes
Accepted

How bad it is using the same IV twice with AES/GCM?

Even a single AES-GCM nonce reuse can be catastrophic. A single nonce reuse leaks the xor of plaintexts, so if one plaintext is known the adversary can completely decrypt the other. This is the same ...
Squeamish Ossifrage's user avatar
16 votes

How much security is gained from hiding the nonce?

Nonces (and initialization vectors) are generally public. Assuming a sensible implementation (using a hash of the message as the nonce is not sensible), then no meaningful security is gained by making ...
hunter's user avatar
  • 3,975
14 votes
Accepted

How much security is gained from hiding the nonce?

Hiding the nonce provides no tangible benefit. In the case of ChaCha where the input block is the concatenation of a constant, the key, a nonce, and a counter, using a random and secret nonce could be ...
forest's user avatar
  • 15.3k
13 votes
Accepted

Is it safe to use a random numbers instead of a counter in ChaCha20?

I am using here the description and terminology from RFC 7539. ChaCha20 is meant to process messages, each message being a sequence of bytes; ChaCha20 produces pseudo-random blocks of 64 bytes each, ...
Thomas Pornin's user avatar
12 votes

Predictable, but private IV in CBC

If a nonce $N_i$ is even, then the binary numeral for it its increment $N_{i+1} = N_i + 1$ differs from $N_i$ only in its least significant bit; and if $N_i$ is odd, its increment is even. This means ...
Luis Casillas's user avatar
11 votes
Accepted

Can I use MAC as CTR mode nonce, if my messages are non-repeating?

Yes, but to use a known algorithm that specifies precisely that, take a look at the SIV mode of operation . "SIV" stands for Synthetic IV. IV is the initialization vector, which is the nonce ...
Maarten Bodewes's user avatar
  • 93.2k
11 votes
Accepted

Would it be safe to use the message hash as the IV in ChaCha?

First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
Squeamish Ossifrage's user avatar
11 votes
Accepted

Does ChaCha20-Poly1305 need random nonce?

No, it doesn't need a random nonce. Yes, if you use an incrementing counter, that works. As the RFC says, the only requirement is uniqueness; as long as you make sure that each nonce you use is ...
poncho's user avatar
  • 148k
11 votes
Accepted

CVE-2024-31497, nonces and random numbers: Can someone explain, please?

The nonces that I know of must be unique (non-repeating), but they may be predicable. Not exactly. The definition of a nonce is that it must be non-repeating. Some schemes that use a nonce have ...
Gilles 'SO- stop being evil''s user avatar
10 votes
Accepted

What advantage is there for using a nonce and a timestamp?

However, if a nonce can provide all the protection a timestamp does, why would they ever be used together? If you use a timestamp in combination with a nonce, it can help mitigate the risk of nonce ...
Luis Casillas's user avatar
10 votes
Accepted

What is the purpose of the "Explicit Nonce" in TLS for AES-GCM and AES-CCM?

This additional 32 bit nonce acts as a salt, and makes multicollision attacks $2^{32}$ times harder. In this attack, the attacker collects a huge number of TLS sessions, each with a record encrypted ...
poncho's user avatar
  • 148k
10 votes
Accepted

Is XChaCha20-Poly1305 nonce misuse-resistant?

The documentation on libsodium AEAD constructions provides more details. Namely, it lists Hk(random ‖ m) as a way to compute a synthetic XChaCha20 nonce. Even if <...
Frank Denis's user avatar
  • 2,973
9 votes

How to Implement Deterministic Encryption Safely in .NET

You can safely use HMAC-SHA256 instead of the SIV mode custom PRF to derive the nonce/authentication tag. There's some caveats: HMAC-SHA256 gives a 256-bit output; you'll have to truncate it to the ...
Squeamish Ossifrage's user avatar
9 votes

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

Usually. However, if you are using 128-bit AES in CTR mode (remember that GCM is essentially just CTR with authentication), then a kind of attack called a multi-target attack can become possible. This ...
forest's user avatar
  • 15.3k
7 votes
Accepted

Is AES-GCM with static key and dynamic salt safe to reuse IV/nonce

In your description, AES/GCM is always used with a new, fresh key, different from all previous keys. Thus, you are not reusing IV with the same key. In that sense, this should be fine from a security ...
Thomas Pornin's user avatar
7 votes

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. No it doesn't (sec. 2.4): The inputs to ChaCha20 are: A 256-bit key A 32-bit initial counter. This can be set to any number, ...
Luis Casillas's user avatar
7 votes

How to prevent accidental nonce reuse with AEAD cipher

If you are having a sequential conversation, like TLS where each record is sent in order before sending the next record, you should use message sequence numbers for the nonce. These will never ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

AES-GCM cipher - Nonce vs IV

The term for the parameter to AES-GCM that must be unique from message to message for any single key is sometimes called ‘nonce’ and sometimes called ‘IV’. The security contract for AES-GCM requires ...
Squeamish Ossifrage's user avatar
7 votes

ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

I realize in ChaCha20 the nonce should be random and unique each time… Nope! For the ChaCha stream cipher, it is not safe to choose the nonce at random. At 64 bits long, the ChaCha nonce is too ...
Squeamish Ossifrage's user avatar
6 votes
Accepted

Why does TLS 1.3 use random-looking nonces for AEAD?

As @CodesInChaos mentions in the comment, the purpose of the nonce randomization in TLS 1.3 is to combat multi-user attacks. That is, attacks where the adversary attacks multiple users simultaneously, ...
hakoja's user avatar
  • 2,725
6 votes

Why does TLS 1.3 use random-looking nonces for AEAD?

An AEAD relies on no reuse of the same pair of key and nonce. Reusing the same key and nonce would be catastrophic. TLS 1.3 uses the same key for multiple records, but constructs a nonce from a ...
Martin Thomson's user avatar
6 votes

Difference between Tweak and nonce

They are somewhat similar. A nonce is a more general concept which might occur in modes of operations or protocols whereas a tweak almost always refers to a tweakable blockcipher. A nonce is a number ...
Elias's user avatar
  • 4,923
6 votes
Accepted

Using the Unix epoch as nonce

Using a Unix Timestamp as the sole source for the nonce would make me nervous. In addition to forged NTP replies (and legitimate operators deliberately resetting the clock for some reason, and I'm ...
poncho's user avatar
  • 148k
6 votes
Accepted

Negating the risk of a random 64-bit nonce

Without looking at the code I would say your construction is pretty much the same as XChaCha20: From https://download.libsodium.org/doc/advanced/xchacha20.html Internally, XChaCha20 works like a ...
Elias's user avatar
  • 4,923
6 votes
Accepted

Message length limit induced by block counter size

From the RFC you can see that a ChaCha20 block is constructed as follows: state = constants | key | counter | nonce Which is then processed in a number of rounds....
Maarten Bodewes's user avatar
  • 93.2k
6 votes

Is it safe to convert a 256-bit nonce into a 192-bit nonce by SHA-256ing and then truncating it?

XChaCha20 requires a 192-bit nonce size. As a rule of Stream ciphers, the nonce should not be repeated under the same key. Note that; Daniel J. Bernstein is pointed in the XSalsa20 article for Salsa20 ...
kelalaka's user avatar
  • 49k
6 votes

I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2

Question: I am not understanding that, what is main purpose of using these implicit nonce and explicit nonce and why it is only sending explicit part only? With the nonce, one important goal we need ...
poncho's user avatar
  • 148k
6 votes

How much security is gained from hiding the nonce?

You can go back to the definition of the word. "Nonce" means "number once". It is a number with one and one feature only - that it is only used once. By definition and design, it ...
AnoE's user avatar
  • 333
5 votes

Is the 'nonce' in bitcoin really a nonce?

I will assume you mean the nonce that bitcoin miners iterate. Depending on e.g. wallet software other salts or nonces may be involved. That nonce is only used once, because every miner1 will be ...
otus's user avatar
  • 32.2k
5 votes

Nonce for AES GCM to prevent replay attacks

Any of the ways you listed would work. If you're collecting alternatives, yet another one (which I have seen in practice) is to include the message counter as the AAD (additional authenticated data), ...
poncho's user avatar
  • 148k

Only top scored, non community-wiki answers of a minimum length are eligible