Nonce

As explained in Real-World Cryptography

A nonce is a value intended to distinguish cryptographic operations and, in signature generation, is typically required to be unique for each signature under a key.

A nonce is a value used to distinguish cryptographic operations. Its exact rules depend on the primitive: an authenticated-encryption nonce generally must not repeat, while an ECDSA signing nonce must be unique, secret, and unpredictable. The name alone is not a specification; follow the algorithm’s documented requirements. section 4.5.2 section 7.3.3

Nonce behavior changes with the construction:

• AES-GCM and AES-CTR use a nonce to help generate a keystream. AES-GCM commonly uses a 96-bit nonce that must be unique but need not be unpredictable. section 4.5.2
• ChaCha20-Poly1305 uses a 12-byte nonce with a counter. Reusing it can reveal the XOR of plaintexts, expose authentication material, and enable forged messages. section 4.5.3
• ECDSA calls its per-signature random value k a nonce or ephemeral key. Repeating or predicting k can recover the private key; RFC 6979 provides deterministic generation. section 7.3.3
• TLS 1.3 starts the authenticated-encryption nonce at a fixed value and increments it for each message, helping detect replay or reordering. section 9.2.2
• Bitcoin miners vary a block’s nonce to produce a hash satisfying the protocol’s target, treating it as a counter or random value. section 12.2.2

The dangerous repeat

Suppose two AES-GCM messages use the same key and nonce. Both produce the same keystream, so XORing their ciphertexts cancels that keystream and reveals the XOR of their plaintexts. In these schemes, nonce management is part of the security boundary, not a cosmetic field. section 4.5.2 section 4.5.3

When repetition is tolerated

AES-GCM-SIV is designed for nonce misuse resistance. Reusing a nonce with different plaintexts reveals less than reuse in AES-GCM or ChaCha20-Poly1305, although avoiding repetition remains preferable. section 4.6.2

Figure 4.13 The AES-CTR algorithm combining the AES cipher with the Counter mode of operation (CTR mode). A unique nonce is concatenated with a counter and encrypted to produce a keystream. The keystream is then XORed with the actual bytes of the plaintext.

Trace how AES-CTR concatenates a unique nonce with a counter, encrypts the result into a keystream, and XORs it with plaintext. section 4.5.2

Figure 12.4 On https://andersbrownworth.com/blockchain/blockchain, one can interactively play with a toy blockchain. Each block includes its parent’s digest, and each block contains a random nonce that allows its digest to start with four 0s. Notice that this is true for the top blockchain, but the bottom one contains a block (number 2) that has been modified (its data was initially empty). As the modification changed the block’s digest, it is no longer authenticated by subsequent blocks.

Interact with a toy blockchain to see how changing a block’s nonce changes its digest and affects subsequent block references. section 12.2.2

How Real-World Cryptography covers it

How deep it goes

Explains nonce roles, sizes, counters, failure consequences, deterministic signing, misuse resistance, and proof-of-work without implementation-level derivations.

Examples

Uses AES-CTR diagrams, ChaCha20 state parameters, ECDSA’s k, TLS record counters, and an interactive Bitcoin blockchain.

What it assumes

Assumes basic familiarity with encryption, authentication, hashing, symmetric keys, digital signatures, and blockchain mining.

What you can do after

Diagnose nonce misuse by checking uniqueness, secrecy, unpredictability, counters, and algorithm-specific documentation before deployment.

How it connects

Connects nonces to authenticated encryption, AES-GCM, ChaCha20-Poly1305, ECDSA, TLS 1.3, replay protection, and proof of work.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreA script nonce is a cryptographically unpredictable token that authorizes a specific inline script under a content security policy.
• 

  liveBookmanning.com
  Hacking CryptographyA cryptographic nonce is a value intended to be used once to prevent identical cryptographic inputs from producing repeated protected outputs.
• 

  liveBookmanning.com
  Software Security for DevelopersA nonce is a value intended to be used only once within a specified cryptographic or authentication context.

Compare how 4 books explain nonce →

Related concepts

• ECDSAused by · ECDSA is a public-key digital signature algorithm that uses elliptic-curve arithmetic to generate and verify signatures.
• replay attackaddresses · A replay attack is an attack in which previously captured valid messages, requests, or authentication data are retransmitted to produce an unauthorized effect.
• initialization vectorincludes · An initialization vector is a typically nonsecret value supplied to a cryptographic operation to initialize or vary its processing across uses.
• Content-Security-Policyconfigures · Content Security Policy is a web security standard that lets a site specify browser-enforced rules restricting the sources and forms of content a document may load or execute.
• authenticated encryption with associated dataused by · Authenticated encryption with associated data is a cryptographic construction that encrypts plaintext while authenticating the ciphertext and optional unencrypted associated data.
• openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.