Understanding IV und Nonce

问题

You sind unsure wenn in verwenden ein IV versus ein nonce und was happens wenn der gleich Wert ist reused across encryptions.

Voraussetzungen

• Understanding of symmetric encryption modes
• Knowledge of CBC and CTR modes

Schritte

1. 1. Distinguish IV from nonce

   An IV (Initialization Vector) is used in CBC mode and must be unpredictable (random). A nonce (number used once) is used in CTR and GCM modes and must be unique but not necessarily random. Both are public and stored with the ciphertext.

   Eingabe

   CBC: random IV | CTR/GCM: unique nonce

   输出

   both public, never reused

2. 2. Understand the consequences of reuse

   Reusing an IV in CBC leaks whether two plaintexts share a prefix. Reusing a nonce in CTR or GCM is catastrophic: it reveals the XOR of two plaintexts and, in GCM, allows forgery of authenticated messages. Never reuse a nonce with the same key.

   Eingabe

   nonce reuse in CTR

   输出

   XOR of plaintexts exposed

3. 3. Generate correctly per mode

   For CBC, generate a fresh random 16-byte IV each time. For GCM, use a counter-based nonce or generate randomly, but track used nonces to prevent reuse. A 96-bit nonce is standard for GCM and allows hardware acceleration.

   Eingabe

   GCM nonce: 12 bytes

   输出

   unique per key

Erwartetes Ergebnis

Correctly generiert IVs/nonces das sind niemals reused mit der gleich Schlüssel, preventing catastrophic Information leakage.

Häufige Fehler

Hardcoding the IV/nonce to a fixed value

Generate a fresh random or counter-based value for every encryption. A fixed IV/nonce defeats the purpose entirely.

Using a random nonce in GCM without tracking uniqueness

With a 96-bit random nonce, the probability of collision is negligible until ~2^32 encryptions. For higher volumes, use a deterministic counter.

Troubleshooting指引

• If two ciphertexts share a prefix and the same IV was used, the IV was reused. Regenerate keys and IVs.
• In GCM, if a nonce is reused even once, the key is compromised. Rotate the key immediately.

Sicherheitsgrenzen

• IV/nonce reuse is one of the most common and devastating cryptographic failures. Always generate fresh values.
• This tool generates IVs locally using a cryptographically secure RNG.