IV と Nonce の理解
IV と Nonce の違い、一意性の要件、再利用の結果を学びます。
问题
IV と Nonce のどちらを使うべきか、また同じ値を暗号化間で再利用すると何が起きるかがわかりません。
前提条件
- 共通鍵暗号のモードの理解
- CBC モードと CTR モードに関する知識
ステップ
-
1. Distinguish IV from nonce
An IV (Initialization Vector) is used in CBC mode and must be unpredictable (random). A nonce (number used once) is used in CTR and GCM modes and must be unique but not necessarily random. Both are public and stored with the ciphertext.
入力CBC: random IV | CTR/GCM: unique nonce输出both public, never reused -
2. Understand the consequences of reuse
Reusing an IV in CBC leaks whether two plaintexts share a prefix. Reusing a nonce in CTR or GCM is catastrophic: it reveals the XOR of two plaintexts and, in GCM, allows forgery of authenticated messages. Never reuse a nonce with the same key.
入力nonce reuse in CTR输出XOR of plaintexts exposed -
3. Generate correctly per mode
For CBC, generate a fresh random 16-byte IV each time. For GCM, use a counter-based nonce or generate randomly, but track used nonces to prevent reuse. A 96-bit nonce is standard for GCM and allows hardware acceleration.
入力GCM nonce: 12 bytes输出unique per key
期待される結果
同じ鍵で決して再利用されない、正しく生成された IV/nonce。壊滅的な情報漏えいを防ぎます。
よくあるエラー
- Hardcoding the IV/nonce to a fixed value
- Generate a fresh random or counter-based value for every encryption. A fixed IV/nonce defeats the purpose entirely.
- Using a random nonce in GCM without tracking uniqueness
- With a 96-bit random nonce, the probability of collision is negligible until ~2^32 encryptions. For higher volumes, use a deterministic counter.
トラブルシューティング指引
- If two ciphertexts share a prefix and the same IV was used, the IV was reused. Regenerate keys and IVs.
- In GCM, if a nonce is reused even once, the key is compromised. Rotate the key immediately.
セキュリティ上の制限
- IV/nonce reuse is one of the most common and devastating cryptographic failures. Always generate fresh values.
- This tool generates IVs locally using a cryptographically secure RNG.