Understanding IV 和 Nonce

问题

你是 unsure 当到 use IV versus nonce 和什么 happens 如果相同值 是 reused across encryptions.

前置条件

• Understanding 的 symmetric 加密 modes
• Knowledge 的 CBC 和 CTR modes

步骤

1. 1. Distinguish IV from nonce

   An IV (Initialization Vector) is used in CBC mode and must be unpredictable (random). A nonce (number used once) is used in CTR and GCM modes and must be unique but not necessarily random. Both are public and stored with the ciphertext.

   输入

   CBC: random IV | CTR/GCM: unique nonce

   输出

   both public, never reused

2. 2. Understand the consequences of reuse

   Reusing an IV in CBC leaks whether two plaintexts share a prefix. Reusing a nonce in CTR or GCM is catastrophic: it reveals the XOR of two plaintexts and, in GCM, allows forgery of authenticated messages. Never reuse a nonce with the same key.

   输入

   nonce reuse in CTR

   输出

   XOR of plaintexts exposed

3. 3. Generate correctly per mode

   For CBC, generate a fresh random 16-byte IV each time. For GCM, use a counter-based nonce or generate randomly, but track used nonces to prevent reuse. A 96-bit nonce is standard for GCM and allows hardware acceleration.

   输入

   GCM nonce: 12 bytes

   输出

   unique per key

预期结果

正确 generated IVs/nonces 该是 从不 reused 具有相同键, preventing catastrophic 信息 leakage.

常见错误

Hardcoding the IV/nonce to a fixed value

Generate a fresh random or counter-based value for every encryption. A fixed IV/nonce defeats the purpose entirely.

Using a random nonce in GCM without tracking uniqueness

With a 96-bit random nonce, the probability of collision is negligible until ~2^32 encryptions. For higher volumes, use a deterministic counter.

排障指引

• If two ciphertexts share a prefix and the same IV was used, the IV was reused. Regenerate keys and IVs.
• In GCM, if a nonce is reused even once, the key is compromised. Rotate the key immediately.

安全限制

• IV/nonce reuse is one of the most common and devastating cryptographic failures. Always generate fresh values.
• This tool generates IVs locally using a cryptographically secure RNG.