Hacker News Reader

This is freaking fantastic- I only wish it existed when I wrote my last encrypted filesystem a few years back.

Nonce collision is a huge concern on large file system deployments. 2^32 seems huge but when you’re writing 100k iops a second on a PB array the chance of collision is almost guaranteed if you’re betting on PRNG randomness.

View on HN

The CAESAR competition [1] ended in 2019 and resulted in multiple different AEADs, most with plenty of nonce space.

[1] https://en.m.wikipedia.org/wiki/CAESAR_Competition

Why is nonce collision a problem though? It just means that two blocks share the same encryption key, right? Without knowing the plaintext in either block, how does that weaken the security of the system?

Encryption with the same key and repeated nonce/counter produce the same cipher stream. Ciphertext in GCM (or CTR) mode is cipherstream XOR plaintext, thus given two ciphertexts with the same key/nonce:

ciphertext1 XOR ciphertext2 = (cipherstream XOR plaintext1) XOR (cipherstream XOR plaintext2) = plaintext1 XOR plaintext2

In GCM it can also break authentication.

Reply on news.ycombinator.com