Skip to main content
Cryptography

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

3
  • 1
    $\begingroup$ Note that using GCM with random nonces, as you propose, gives people the heebie-jeevies. Since ECIES uses ephemeral per-message keys you're possibly safe in this one case, but you might want to stick to a counter nonce, or at least beware of carrying that assumption to other settings. $\endgroup$ Commented Jul 17, 2018 at 21:55
  • $\begingroup$ Yeah, using bytes from the hash of the shared key as the key and nonce now... seems to be the popular option. $\endgroup$ Commented Jul 19, 2018 at 15:22
  • $\begingroup$ Random nonces is a lot safer than sequential nonces. The people for whom it has problems aren't looking at whole systems. Sequences are safer, but... how do you custody the sequence? Random numbers generally have operating system and sometimes hardware custody, and a 128 bit nonce offers enough collision detection to transmit yottabytes before there's a significant problem. Only sneaky gotcha is that the openssl lib will truncate your nonce to 96 bits unless you tell it not to. $\endgroup$ Commented Aug 14, 2018 at 12:55