5 ms·
To be honest, nonce reuse with Bernsteins authenticated encryption algorithms will lead to the same problem as those the author points out with GCM (i.e. plaint
by onlydnaq 10y ago
To be honest, nonce reuse with Bernsteins authenticated encryption algorithms will lead to the same problem as those the author points out with GCM (i.e. plaintext recovery). However, the biggest issue with GCM isn't that the plaintext leaks when reusing nonces, it's the fact that reusing nonces leads to an attacker being able to forge arbitrary ciphertexts.
- loup-vaillant 10y agoBut… Poly1305 has the same "problem"…
- tptacek 10y agoGuttman's wording here is imprecise. GCM and Poly1305 are not comparably brittle. Both have nonce misuse issues, but GCM has additional problems. See: https://news.ycombinator.com/item?id=13384762 https://news.ycombinator.com/item?id=13384762