Skip to content

Nonce reuse

Level: 301 · deep dive

Stub — an outline, not a lesson. There is no runnable example behind this page yet, so nothing on it has been through the check that backs every other claim in this library. The bullets below are the questions the finished page has to answer.

One line: One number used twice, and the plaintext falls out.

The questions this page has to answer

  • Encrypt two messages with one CTR-mode nonce, XOR the ciphertexts, and watch the key cancel.
  • Why is this catastrophic for GCM specifically — not just confidentiality, but the authentication key?
  • The ECDSA k: the same failure in a signature, and how it exposed the PS3 signing key.
  • How do real systems get here? (A counter reset on restart; a VM snapshot; a random nonce in a 64-bit field.)
  • What is a nonce-misuse-resistant mode, and what does it cost?

See also