Concepts
Nonces, IVs and the danger of reuse
Making each encryption unique
How it works
An initialisation vector (IV) or nonce ('number used once') is an extra input that makes encrypting the same plaintext under the same key produce different ciphertext. It is usually not secret and is sent with the ciphertext. Some modes only require uniqueness (CTR, GCM, ChaCha20), while CBC also requires the IV to be unpredictable.
Strengths
- Allows one key to protect many messages safely
- Hides repeated plaintext
Weaknesses and known attacks
- Nonce reuse in stream modes (CTR, GCM, ChaCha20) reuses keystream and exposes the XOR of plaintexts; in GCM it also enables forgeries.
- WEP's 24-bit IV repeated quickly on busy networks, enabling practical key recovery.
- Predictable CBC IVs enabled the BEAST attack.
- Reusing the per-signature nonce in ECDSA reveals the private key.
Use it for
- Every encryption operation with a stream or AEAD mode, using a counter or a sufficiently large random value
Don't use it for
- Fixed, hard-coded or reset-prone nonces
Exam tip
An IV attack (as in WEP) is about IV reuse. The fix is a mode and protocol that never repeats the IV under one key, plus regular rekeying.