3 ms·
> Aside from just not understanding it, it's plausible that someone would generate nonces weakly, say, from a weak source of randomness. This is actually gener
by stouset 2y ago
> Aside from just not understanding it, it's plausible that someone would generate nonces weakly, say, from a weak source of randomness.
This is actually generally fine for nonces (used in CTR and GCM modes, and in ChaCha20). Typically the only requirement for a nonce is that it is only used once. It is even safe to use a simple incrementing counter.
IVs, on the other hand, are required to be cryptographically random.
- Retr0id 2y agoMy point is that a random AES-GCM nonce is a problem because you will end up re-using nonces by chance, assuming multiple messages are being encrypted with the same key. Due to the small nonce size, this is still a problem even with secure randomness, it's just even more of a problem with weak randomness.
- stouset 2y agoWhoops, sorry. Slept poorly last night and missed this. You're 100% right, GCM doesn't have enough bits in the nonce to safely generate them randomly for any case where keys are reused significantly.