{
  "slug": "cryptographic-nonce",
  "term": "Cryptographic nonce",
  "aliases": [
    "Nonce"
  ],
  "definition": "A cryptographic nonce is an input value whose required uniqueness scope is specified by the cryptographic construction that uses it.",
  "note": "For RFC 5116's AES-GCM profiles, encryption must not reuse a nonce under one key; repeated decryption is different. VM rollback can cause reuse by restoring earlier encryption state. Nonce handling therefore belongs in snapshot recovery reviews. [rfc5116] XTS sector-number tweaks have a different contract and must not be treated as GCM nonces. [broz2018]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "A nonce is not itself a freshness policy that rejects old, valid ciphertext.",
      "citationIds": [
        "rfc5116"
      ]
    }
  ],
  "related": [
    "authenticated-encryption",
    "xts-aes",
    "snapshot",
    "replay-attack"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "rfc5116",
      "title": "RFC 5116: nonce requirements, GCM reuse and VM rollback, sections 2.1, 3.1, 5.1.1 and 8",
      "url": "https://www.rfc-editor.org/rfc/rfc5116.html",
      "accessed": "2026-10-15"
    },
    {
      "id": "broz2018",
      "title": "Broz, Patocka and Matyas: Practical cryptographic data integrity protection with full disk encryption, 2018, sections 2.4 and 3.3",
      "url": "https://arxiv.org/pdf/1807.00309v1",
      "accessed": "2026-10-15"
    },
    {
      "id": "hesela-encryption",
      "title": "Hesela: Nonce reuse is not ciphertext replay",
      "url": "https://hesela.com/analyses/checksums-identity-and-lost-writes/#nonce-reuse",
      "accessed": "2026-10-15"
    }
  ],
  "updated": "2026-10-15"
}