Nonce and initialisation vector (IV)

In short: A nonce (“number used once”) and an initialisation vector are extra values that make sure the same message under the same key is encrypted differently each time.

In more detail: They are not secret, but their properties are crucial: a nonce must never repeat, an IV must, depending on the mode, be unpredictable (random).

In Depth

• Why needed: Without them, equal plaintexts would give equal ciphertexts, and repetitions would be visible.
• Nonce: Often a counter or a random value. With CTR/GCM/ChaCha20 “unique” is enough, randomness is not required, but repetition is fatal: two messages with the same key and nonce reveal the XOR of their plaintexts, and with GCM the authentication key can be exposed.
• IV with CBC: Must be random and unpredictable.
• Sending along: Nonce/IV is usually prepended to the ciphertext and sent in the clear.
• Random nonces: With 96 bits and very many messages a collision looms (birthday paradox). Then counters or key rotation are better. See random numbers.
• Outside encryption: In login protocols and blockchains as a one-time value against replay.

See also: ChaCha20-Poly1305