How safe is store nonce with encrypted text?

Question

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in decrypted form is the application RAM.

Now, when the application is launched, the user enters one decryption key and a nonce for each key. This is very uncomfortable, all the nonce are stored separately from the database where the encrypted keys are stored.

Is it safe to store nonce next to encrypted text? For example - nonce + ciphertext . That is, if an attacker has gained access to encrypted data, will it be easier for him to decrypt the keys if he knows the nonce? If not, then why do all libraries separate the nonce from the ciphertext, and not concatenate it?

Does this answer your question? What is the main difference between a key, an IV and a nonce?. Where did you see that they all are separating? You should say the libraries that I see ( with some lists) sperates... — kelalaka, Oct 06 '21 at 15:33
@kelalaka https://pkg.go.dev/crypto/cipher#AEAD.Open and this example - https://gist.github.com/kkirsche/e28da6754c39d5e7ea10 — riwasat604, Oct 06 '21 at 16:01
They are just examples of simple AES-GCM encryption. Nothing is serious. The only plausible reason is that they fear the IV/nonce-reuse of AES-GCM which can cause loss of confidentiality and forgeries. They may query the nonce/IV column to mitigate this. Instead one can use AES-GCM-SIV mode or XChaCha20-Poly1305 as a better alternative, 192-bit nonces. — kelalaka, Oct 06 '21 at 16:18
@kelalaka But if I store the nonce together with the decryption key, and not concatenate it with the encrypted text, then it will be much more difficult for a hacker to hack the secret data? — riwasat604, Oct 06 '21 at 19:52
Is storing the nonce separately from the ciphertext for greater security a bad practice? — riwasat604, Oct 06 '21 at 20:00
The nonce doesn't mean to be secret. There is no secrecy on it. Just use a Master key and derive them? have you ever heard of password managers? Simply user have one strong master password ( possibly dicewire) and using HKDF to derive the master key, using this master key decrypt other keys and use them. — kelalaka, Oct 06 '21 at 20:00
You might be interested in this; Is it dangerous to encrypt lots of small files with the same key? — kelalaka, Oct 07 '21 at 07:53

How safe is store nonce with encrypted text?

0 Answers0