11

My question maybe will be stupid, but my problem is that I do not understand why stream ciphers need a key and also a nonce. As far as I understand, the keystream is generated with the nonce. The same key can be reused with a different nonce.

Wouldn't be simpler just to use a new key each time? If I understand good, to decrypt the message the recipient needs the nonce. Is communicating the nonce simpler than communicating the key?

otus
  • 32,132
  • 5
  • 70
  • 165
robert
  • 253
  • 2
  • 10

1 Answers1

16

By the modern definition of a cipher, it must be possible to encipher several messages with the same secret key. That's also a practical necessity, due to the difficulty of securely establishing a shared secret key. That issue is solved with the nonce, which is not secret, and can be transferred as part of the ciphertext (typically: at the beginning).

Without nonce, or if the nonce repeats, the keystream would repeat, and that would allow breaking the cipher, e.g. with a single known plaintext.

Because the nonce is not secret, communicating the nonce is simpler than securely communicating the key. Altering the nonce would alter the deciphered message, but a generic stream cipher is not supposed to allow detection of alterations anyway.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • 1
    Can you elaborate a little further on why the keystream repeating would allow you to break it? Do you need both the keystream repeating and a guess about the plaintext? How much plaintext would you need to break the cipher? – Kevin Burke Jul 24 '17 at 02:40
  • @Kevin Burke: the answer does NOT state that "the keystream repeating would allow you to break it", with it referring to keystream; that would be incorrect. The answer states that a repeating keystream would allow breaking the cipher. That stands per nearly all formal definition of cipher security, including IND-CPA (a common academic definition), and Known Plaintext. Fixed keystream also allows recovering most plaintext with minimal statistical knowledge about plaintext (being English text in ASCII) and a few ciphertexts. – fgrieu Jul 24 '17 at 08:53