Search code examples
cryptographylibsodiumnonce

Is it safe to have the next value of a cryptographic nonce be pre-computed based on past values?


The server shall only need to use pseudo-random generator to create the first nonce upon initialization and this value the client shall be made aware of. This nonce shall be used on first encryption request and then the server calculates the next value of the nonce based on certain attributes of that response an ability that both client and server is able to do. The second encryption request will use the updated value of the nonce and so on. This is like how initialization vector works in other solutions.

Since nonce are publicly visible values, and base on initial research it's public visibility has no effect on security, my question here is only with regards to the generation of chain of nonce values rather than randomly. The benefit is it shall form a link between client and server in the encryption requests.

I am using libsodium crypto system.


Solution

  • A nonce doesn't have to be secret just random. i.e. not reused. It's fine once you can satisfy this. I suggest a hash ratchet of the nonce.