4 ms·

XSalsa20 uses 192-bit nonce in order to make the probability of collision of randomly-generated nonces negligible for some definition of negligible. Is there an

• loup-vaillant 9y ago
  That one bothered me as well, but it may suffice. The probability of collision, for 2^R random values of N bits is about 2^(2R-N). Lets' assume you want a probability of collision of less than 2^-64 (I think this is negligible enough). With 192 bits, this allows up to 2^64 nonces, which is quite hard to exceed in practice. 128 bits however only support up to 2^32 random nonces per key (a few millions). Some applications may exceed this threshold, but this is a backup we're talking about. You probably won't update it more than a million times in your lifetime, which most likely will span less than 30 thousand days from now.