English
Menu

What is Nonce?

In cryptography, a value used only once under the same key; the name means "number used once". In CTR mode and GCM, using the same key and nonce twice produces the same keystream and leaks the XOR of the plaintexts, so a counter or similar is used to keep values from repeating. The initialization vector (IV) used in CBC mode must not only be unique but also unpredictable to an attacker. Neither needs to be kept secret; they are usually sent together with the ciphertext. A fresh random number sent in an authentication protocol to prevent old responses from being replayed is also called a nonce.

Japanese name: ナンス

Nonce appears in 6 practice questions across 2 topics, including Applied Cryptography, Hardware Security: Advanced Topics and Trends.

Field: Applied Cryptography

Try it: questions about Nonce

Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?

  1. AKeep the IV secret like the key and keep using the same value for every message
  2. BThe IV need not be secret, but choose a new random value for each message that an attacker cannot predict
  3. CThe IV need not be secret, and it may be fixed to the same value agreed with the other party (for example all zeros) every time
Show answer and explanation

Answer: B. The IV need not be secret, but choose a new random value for each message that an attacker cannot predict

In CBC mode each plaintext block is XORed with the previous ciphertext block before being encrypted, and the first block is XORed with the IV. The IV is usually sent at the beginning of the ciphertext, so it need not be kept secret. However, if the same IV is used every time, messages that begin the same way also produce ciphertexts that begin the same way, revealing that parts of the contents are identical. Furthermore, if an attacker can predict the next IV, attacks are known that guess contents by having chosen plaintexts encrypted (such as the BEAST attack on TLS 1.0).

In CTR mode, two messages were mistakenly encrypted with the same key and the same nonce. For the byte at one position, the first plaintext P₁ is 01001000 (ASCII "H"), its ciphertext C₁ is 01110100 and the second ciphertext C₂ is 01010101. If the attacker knows P₁, which of the following is the second plaintext P₂ at the same position?

  1. A00100001
  2. B00111100
  3. C01101001
Show answer and explanation

Answer: C. 01101001

With the same key and nonce the keystream K is the same, so C₁ = P₁ ⊕ K and C₂ = P₂ ⊕ K. First K = P₁ ⊕ C₁ = 01001000 ⊕ 01110100 = 00111100 is found, and then P₂ = C₂ ⊕ K = 01010101 ⊕ 00111100 = 01101001 (ASCII "i"). Without knowing the key, knowing one plaintext directly gives the other. For this reason, never using the same nonce twice under the same key is an essential condition in CTR mode and GCM.

Nonce in the explanations

Questions that mention Nonce (6)

  1. Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?
  2. In CTR mode, two messages were mistakenly encrypted with the same key and the same nonce. For the byte at one position, the first plaintext P₁ is 01001000 (ASCII "H"), its ciphertext C₁ is 01110100 and the second ciphertext C₂ is 01010101. If the attacker knows P₁, which of the following is the second plaintext P₂ at the same position?
  3. Which of the following correctly describes the 96-bit nonce (IV) used in AES-GCM?
  4. Which of the following correctly describes the difference between block ciphers and stream ciphers among symmetric-key ciphers?
  5. Which of the following correctly describes a feature of CTR mode (counter mode) of a block cipher?
  6. In confidential computing, a user's verification server (the verifier) checks the attestation report received from a VM-based TEE before handing over the key that decrypts the data. Which is the most appropriate set of things for the verifier to check?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Block cipher mode of operation AES (Advanced Encryption Standard) Authenticated encryption (AEAD) TLS Confidential computing Trusted execution environment (TEE) Birthday attack Certificate authority Crypto agility Diffie–Hellman key exchange

Back to the glossary