5 ms·
I dunno, nonce means number-used-once, it should be kinda obvious that it should be used only once?
by bux93 2y ago
I dunno, nonce means number-used-once, it should be kinda obvious that it should be used only once?
- frereit 2y agoCorrect. However, some implementations actually incorrectly refer to the nonce as an "IV" (initialization vector), where it's not so obvious. Also, it's not entirely clear just how bad a reuse actually is. For example, in AES-CBC, reusing the IV has much less impact than reusing the nonce with AES-GCM.
- kbolino 2y agoNIST calls it an IV (or at least did when it came out).
- Retr0id 2y agoAnd yet... Aside from just not understanding it, it's plausible that someone would generate nonces weakly, say, from a weak source of randomness. Even using a strong source of randomness for an AES-GCM nonce is weak over enough messages, since it only gets you 48 bits of collision resistance. If you're not using random nonces, maybe you want to use a counter, and then you have to worry about race conditions, state resets, etc. (if your system lost power immediately after using nonce n, would it boot back up and reuse it?)
- stouset 2y ago> Aside from just not understanding it, it's plausible that someone would generate nonces weakly, say, from a weak source of randomness. This is actually generally fine for nonces (used in CTR and GCM modes, and in ChaCha20). Typically the only requirement for a nonce is that it is only used once. It is even safe to use a simple incrementing counter. IVs, on the other hand, are required to be cryptographically random.
- Retr0id 2y agoMy point is that a random AES-GCM nonce is a problem because you will end up re-using nonces by chance, assuming multiple messages are being encrypted with the same key. Due to the small nonce size, this is still a problem even with secure randomness, it's just even more of a problem with weak randomness.
- stouset 2y agoWhoops, sorry. Slept poorly last night and missed this. You're 100% right, GCM doesn't have enough bits in the nonce to safely generate them randomly for any case where keys are reused significantly.
- formerly_proven 2y agoThe consequences that using the number used once twice entail differ wildly between cryptosystems though.
- davidczech 2y agoI've seen the problem surface in designs where a single key is shared across many devices.
- hifromwork 2y agoAlso depending on the cryptosystem, nonce requirements vary wildly. For example using 1, 2, 3, 4... as a nonce for CTR is a recipe for disaster, but it's fine for many asymmetric ciphers.