4 ms·
Interesting. There's also "XChaCha20-Poly1305", with a 192-bit nonce (long enough to be chosen randomly), but I don't know if this is standardized. It seems to
by nemo1618 8y ago
Interesting. There's also "XChaCha20-Poly1305", with a 192-bit nonce (long enough to be chosen randomly), but I don't know if this is standardized.
It seems to me that using a long, explicit, random nonce is always preferable to using a short, implicit, sequential nonce. Are there any systems that really can't accommodate this?
- jedisct1 8y agoIt's on the standard track: https://tools.ietf.org/html/draft-arciszewski-xchacha-03 https://tools.ietf.org/html/draft-arciszewski-xchacha-03
- emilfihlman 8y agoYes, many and a lot. High quality random sources are not a general availability, for example in small devices. The best would be to have a strong random nonce and a counter, or some combination of these, for example 64 bit counter appended to a 192 bit random vector. Even just a 64 bit sequential counter would last almost 600 years at 10^9 encryption operations per second.