3 ms·

With a reused nonce: can you reverse the key used? Decrypt that packet? All the packets with that nonce? All packets?

• lvh 10y ago
  In the specific case of GCM: you can trivially recover the authentication key, and you can (in realistic circumstances) decrypt the messages for which the once was repeated. That, in turn, means you can recover the keystream for that nonce, key pair, meaning if the peer accepts new messages with the repeated nonce (realistic), you can forge arbitrary messages of the same length of shorter than the longest ciphertext for which the nonce repeated.
  • runn1ng 10y ago
    How cryptographically tested is GCM-SIV? Can it be used today, with the most common crypto-suites? Should it be used?
    • lvh 10y ago
      The authors don't suggest using it for anything. There is at least one more NMR (nonce misuse resistant) cipher in the current round of the CAESAR competition, AEZ. I have my own one built on top of libsodium primitives, called magicnonce. I don't think any of them are sufficiently well-vetted for you to start considering them for general purpose use right now. If you're bothered by nonce reuse, consider a different primitive. While libsodium's secretbox also has serious nonce reuse problems, it doesn't really matter because you can just select it at random.