Understanding IV and Nonce

Problem

You are unsure when to use an IV versus a nonce and what happens if the same value is reused across encryptions.

Prerequisites

• Understanding of symmetric encryption modes
• Knowledge of CBC and CTR modes

Steps

1. 1. Distinguish IV from nonce

   An IV (Initialization Vector) is used in CBC mode and must be unpredictable (random). A nonce (number used once) is used in CTR and GCM modes and must be unique but not necessarily random. Both are public and stored with the ciphertext.

   Input

   CBC: random IV | CTR/GCM: unique nonce

   Output

   both public, never reused

2. 2. Understand the consequences of reuse

   Reusing an IV in CBC leaks whether two plaintexts share a prefix. Reusing a nonce in CTR or GCM is catastrophic: it reveals the XOR of two plaintexts and, in GCM, allows forgery of authenticated messages. Never reuse a nonce with the same key.

   Input

   nonce reuse in CTR

   Output

   XOR of plaintexts exposed

3. 3. Generate correctly per mode

   For CBC, generate a fresh random 16-byte IV each time. For GCM, use a counter-based nonce or generate randomly, but track used nonces to prevent reuse. A 96-bit nonce is standard for GCM and allows hardware acceleration.

   Input

   GCM nonce: 12 bytes

   Output

   unique per key

Expected result

Correctly generated IVs/nonces that are never reused with the same key, preventing catastrophic information leakage.

Common errors

Hardcoding the IV/nonce to a fixed value

Generate a fresh random or counter-based value for every encryption. A fixed IV/nonce defeats the purpose entirely.

Using a random nonce in GCM without tracking uniqueness

With a 96-bit random nonce, the probability of collision is negligible until ~2^32 encryptions. For higher volumes, use a deterministic counter.

Troubleshooting

• If two ciphertexts share a prefix and the same IV was used, the IV was reused. Regenerate keys and IVs.
• In GCM, if a nonce is reused even once, the key is compromised. Rotate the key immediately.

Security limits

• IV/nonce reuse is one of the most common and devastating cryptographic failures. Always generate fresh values.
• This tool generates IVs locally using a cryptographically secure RNG.