CyberGlossary

Cryptography

Nonce

Also known as: Number used once, Cryptographic nonce

Definition

A "number used once" supplied to a cryptographic algorithm to guarantee freshness and prevent replay or key/IV reuse.

A nonce is an input that must not repeat within the lifetime of a key, used by symmetric ciphers, AEAD modes, signature schemes, and authentication protocols to ensure each operation is unique. In AEAD modes like AES-GCM or ChaCha20-Poly1305, nonces are typically 96 bits and may be generated as random values or as a deterministic counter; reusing an AES-GCM nonce under the same key catastrophically breaks confidentiality and authentication. Nonces also appear in TLS handshakes, OAuth/OIDC challenges, Bitcoin block headers, and signature schemes such as ECDSA, where nonce reuse leaks the private key. Best practice is to use either random nonces of sufficient length or a strictly monotonic counter, and to switch to misuse-resistant modes (AES-GCM-SIV, XChaCha20-Poly1305) when collisions cannot be ruled out.

Examples

  • TLS 1.3 derives per-record AEAD nonces by XOR-ing a sequence number with the per-direction IV.
  • The 2010 PlayStation 3 ECDSA private-key recovery happened because Sony reused the signature nonce.

Related terms