Nonce and IV Reuse
Reusing a nonce or IV with the same key in stream and GCM modes is catastrophic: keystream or authentication key reuse enables plaintext recovery and forgery, not a gradual weakness.
Definition
Nonces and initialization vectors make encryption probabilistic: the same plaintext under the same key must encrypt differently each time. Reusing a nonce with a counter or GCM mode reuses the keystream — XOR of ciphertexts reveals the XOR of plaintexts — and in GCM reuses the authentication subkey, enabling universal forgery. Requirements: uniqueness per key, ideally randomness or strict monotonic counters.
Context and scope
Applies to AES-GCM and ChaCha20-Poly1305 usage, encrypted cookie formats, session ticket encryption, and any application-level cipher built by hand.
Common misconceptions
- A 96-bit random nonce cannot collide — with enough messages under one key, birthday collisions arrive faster than intuition suggests; random nonces need wider widths or counters
- Key rotation forgives reuse — the uniqueness requirement is per key; reuse under a rotated key is fine, reuse under the same key is fatal
- Authenticated encryption hides the problem — AEAD detects tampering but nonce reuse breaks confidentiality and the tag independently
Anti-patterns
- Generating random 96-bit nonces for high-volume AES-GCM streams under a long-lived key
- Deriving IVs from predictable request attributes such as record ids without a counter safeguard
- Building custom encrypted formats instead of using vetted library interfaces that manage nonces
Related concepts
Related examples
Authoritative source
What it is
Deterministic encryption leaks equality and enables dictionary attacks, so modes inject a nonce to vary output per message. The safety contract is one-time use per key. Breaking it does not weaken the cipher gradually — it hands the attacker equations relating plaintexts or the authentication key outright.
How it works
In counter-based modes, the nonce seeds the keystream. Reuse means the same keystream XORs two plaintexts; canceling it out yields plaintext-XOR-plaintext, which structured formats make readable. In GCM, nonce reuse exposes the authentication subkey H, after which tags can be forged for chosen ciphertexts. Counters and random nonces of sufficient width are the sanctioned strategies; XChaCha and SIV modes relax the uniqueness requirement.
When to audit
Any direct cipher API call, encrypted cookie or token format, and file or column encryption built in-house. Prefer libraries that accept plaintext and key only, choosing and tracking nonces internally. Monitor per-key message counts against safe bounds.
Pitfalls
Process restarts reset in-memory counters — persist or derive counters statelessly. Random nonces under high volume collide by birthday paradox: at 96 bits, billions of messages approach dangerous odds. Misuse-resistant modes like AES-GCM-SIV trade a little performance for surviving accidental reuse.