Hacker News new | past | comments | ask | show | jobs | submit login

As I understand it, the limitation people are concerned about is that of the IV/counter block. It's not that you can't hash an arbitrarily large nonce down to 96 bits; you obviously can. It's that ultimately you've only got 96 bits on the wire to express your nonce, and if they collide GCM falls apart. That's the X trick in XSalsa: the wider nonce gets laundered into the key.



Looking at the implementation, the longer nonce is hashed to 128 bits, with the last 32 used as a starting counter. So, if you don't use the whole 32 bits space of the counter, you are effectively using more than 96 bits nonce.

Sure, no more than 128 bits, but indeed better than 96.


Right, and 128 bits is way better than 96.

The only thing to potentially be aware of is that the randomized block counter may end up overflowing if it happens to end up with a large initial value (or you encrypt large messages). That should be fine, but it's quite likely that some GCM implementations are not expecting that and either blow up when the counter resets to 0 or do something else unexpected. So although I think this is theoretically a fine thing to do, I absolutely wouldn’t trust my sensitive data to it.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: