cryptographic-nonce · shipping · also Nonce

Cryptographic nonce

A cryptographic nonce is an input value whose required uniqueness scope is specified by the cryptographic construction that uses it.

Related Observatory article: Cryptographic nonce on hesela.com

For RFC 5116's AES-GCM profiles, encryption must not reuse a nonce under one key; repeated decryption is different. VM rollback can cause reuse by restoring earlier encryption state. Nonce handling therefore belongs in snapshot recovery reviews. [1] XTS sector-number tweaks have a different contract and must not be treated as GCM nonces. [2]

Relations

related

authenticated-encryption, xts-aes, snapshot

Limitations

• A nonce is not itself a freshness policy that rejects old, valid ciphertext. [1]

Citations

1. RFC 5116: nonce requirements, GCM reuse and VM rollback, sections 2.1, 3.1, 5.1.1 and 8 (accessed 2026-10-15)
2. Broz, Patocka and Matyas: Practical cryptographic data integrity protection with full disk encryption, 2018, sections 2.4 and 3.3 (accessed 2026-10-15)
3. Hesela: Nonce reuse is not ciphertext replay (accessed 2026-10-15)

JSON: /data/terms/cryptographic-nonce.json