Nonce Generators and the Nonce Reset Problem

Erik Zenner

    Research output: Chapter in Book/Report/Conference proceedingArticle in proceedingsResearchpeer-review


    A nonce is a cryptographic input value which must never repeat within a given context. Nonces are important for the security of many cryptographic building blocks, such as stream ciphers, block cipher modes of operation, and message authentication codes. Nonetheless, the correct generation of nonces is rarely discussed in the cryptographic literature. In this paper, we collect a number of nonce generators and describe their cryptographic properties. In particular, we derive upper bounds on the nonce collision probabilities of nonces that involve a random component, and lower bounds on the resulting nonce lengths. We also discuss an important practical vulnerability of nonce-based systems, namely the nonce reset problem. While ensuring that nonces never repeat is trivial in theory, practical systems can suffer from accidental or even malicious resets which can wipe out the nonce generators current state. After describing this problem, we compare the resistance of the nonce generators described to nonce resets by again giving formal bounds on collision probabilities and nonce lengths. The main purpose of this paper is to provide a help for system designers who have to choose a suitable nonce generator for their application. Thus, we conclude by giving recommendations indicating the most suitable nonce generators for certain applications.
    Original languageEnglish
    Title of host publicationProceedings ISC 2009
    EditorsP. Samarati
    Publication date2009
    Publication statusPublished - 2009
    EventInformation Security Conference - Pisa, Italy
    Duration: 1 Jan 2009 → …


    ConferenceInformation Security Conference
    CityPisa, Italy
    Period01/01/2009 → …
    SeriesLecture Notes in Computer Science


    Dive into the research topics of 'Nonce Generators and the Nonce Reset Problem'. Together they form a unique fingerprint.

    Cite this