Nonce
A nonce is a value intended for one-time use within a specified cryptographic, authentication, or authorization context.
Real-World Cryptography
A nonce is a value intended to distinguish cryptographic operations and, in signature generation, is typically required to be unique for each signature under a key.
- How it is used
- Uses nonces to separate cryptographic operations, generate keystreams, sequence transport records, sign messages, and search blockchain hashes.
- How deep it goes
- Explains nonce roles, sizes, counters, failure consequences, deterministic signing, misuse resistance, and proof-of-work without implementation-level derivations.
- Examples
- Uses AES-CTR diagrams, ChaCha20 state parameters, ECDSA’s k, TLS record counters, and an interactive Bitcoin blockchain.
- What you can do after
- Diagnose nonce misuse by checking uniqueness, secrecy, unpredictability, counters, and algorithm-specific documentation before deployment.
Building Web APIs with ASP.NET Core
A script nonce is a cryptographically unpredictable token that authorizes a specific inline script under a content security policy.
- How it is used
- Authorizes one inline script under a Content-Security-Policy header during deployment testing.
- How deep it goes
- Defines the nonce, applies matching values in the policy and script element, and warns against production inline scripts.
- Examples
- Demonstrates a nonce in Program.cs for /cod/test and verifies the resulting JavaScript alert after redeployment.
- What you can do after
- Apply it via a Content-Security-Policy header and matching script attribute, then verify browser execution after redeployment.
Read how Building Web APIs with ASP.NET Core explains nonce →
Hacking Cryptography
A cryptographic nonce is a value intended to be used once to prevent identical cryptographic inputs from producing repeated protected outputs.
- How it is used
- Uses nonce uniqueness to secure ECDSA signing and to expose how faulty randomness compromises digital signatures.
- How deep it goes
- Derives nonce and private-key recovery, implements the failure in Go, and stops short of partial-nonce lattice attacks.
- Examples
- Demonstrates fixed-nonce Go signing, repeated r values, two-signature recovery, and verification of a newly forged signature.
- What you can do after
- Diagnose/debug with it by recognizing reused ECDSA nonces and tracing recovery of the nonce and private signing key.
Software Security for Developers
A nonce is a value intended to be used only once within a specified cryptographic or authentication context.
- How it is used
- Protects OIDC authentication responses and cryptographic operations from replay through single-use values.
- How deep it goes
- Defines nonce use, explains request-to-token matching and IV reuse risks, but defers the mathematics of encryption-mode consequences.
- Examples
- Uses OIDC authentication responses, intercepted payment requests, and AES-CBC encryption of multiple files.
- What you can do after
- Apply it via OIDC validation and AES-CBC IV management to reject reused authentication data and avoid key-IV reuse.
Related concepts
- ECDSAused by · ECDSA is a public-key digital signature algorithm that uses elliptic-curve arithmetic to generate and verify signatures.
- replay attackaddresses · A replay attack is an attack in which previously captured valid messages, requests, or authentication data are retransmitted to produce an unauthorized effect.
- initialization vectorincludes · An initialization vector is a typically nonsecret value supplied to a cryptographic operation to initialize or vary its processing across uses.
- Content-Security-Policyconfigures · Content Security Policy is a web security standard that lets a site specify browser-enforced rules restricting the sources and forms of content a document may load or execute.
- authenticated encryption with associated dataused by · Authenticated encryption with associated data is a cryptographic construction that encrypts plaintext while authenticating the ciphertext and optional unencrypted associated data.
- openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.