Nonce reuse

What it means

Nonce reuse is when a value that was meant to be used once appears a second time. A nonce is only safe because it does not repeat. In many cryptographic schemes it must not repeat under the same key, and the standard says so plainly.

The rule is stricter than it sounds. The value need not be secret and need not be random. It just must be new each time. The failure does not announce itself: the program runs and the data looks encrypted. Only the underlying guarantee has quietly gone.

Why it matters

In some encryption modes, reusing a nonce with the same key reveals relationships between messages and can let an attacker forge new ones. NIST SP 800-38D, which covers AES-GCM, warns that repeating the IV under one key destroys the security assurances. In signature schemes, a repeated per-signature value can expose the private key.

The damage is often permanent. Once data is encrypted badly and copied to backups, you cannot make it safe again by fixing the code. You re-encrypt or rotate the key, and tell customers why. That is a costly week for a one-line mistake.

How it shows up

It shows up where code builds its own encryption calls: a nonce hardcoded as zeros, a counter that restarts after a deployment, two servers each counting from one, or a random nonce too short to avoid collisions across billions of messages. See initialisation vectors and AES-GCM.

At application level, the same idea covers one-time links, payment tokens and single-use coupons that can be used again. Check where the nonce is created, whether it is stored or derived, and what happens after a restart or a failover. Prefer library functions that manage nonces for you, and rotate keys on schedule.