Cybersecurity glossary
What is a Nonce?
Learn what a cryptographic nonce is, why number-used-once values must be unique, how AEAD ciphers depend on nonce safety, how nonces differ from IVs, and how they help stop replay attacks.
Definition
A nonce is a value intended to be used once in a cryptographic context, often to guarantee uniqueness, bind a protocol message to one session, or prevent replay; depending on the algorithm it may need to be unpredictable, unique, or both.
Why "number used once" matters
A nonce is a "number used once": a value chosen so one cryptographic operation is distinguishable from every other operation in the same context. The word says "number," but real-world nonces are often byte strings, counters, timestamps plus counters, or random values produced by a CSPRNG.
The exact rule depends on the protocol. Some nonces must only be unique. Others must also be unpredictable before they are used. Confusing those requirements is where many nonce bugs begin.
Where nonces show up
Authenticated encryption
AEAD modes use a nonce with the key so encrypting two messages does not repeat the same keystream or counter state.
Replay defenses
Challenge-response protocols and message counters reject stale packets that carry an old nonce.
Protocol binding
Login and token flows use nonces to bind an artifact to the request that caused it.
Web allowlisting
CSP nonces are per-response values that let a browser run only trusted inline scripts or styles.
How nonce handling works in AEAD
Choose an encryption key
A key defines the scope where nonce uniqueness must be maintained.
Generate a fresh nonce
Use the algorithm's required nonce length and generation rule: random, counter-based, or protocol-derived.
Encrypt with associated data
The AEAD mode authenticates plaintext and metadata while incorporating the nonce into its internal state.
Send the nonce with ciphertext
The nonce is usually public and travels beside the ciphertext so the receiver can decrypt.
Never reuse under the same key
A repeated nonce-key pair can break confidentiality and integrity assumptions.
Nonce vs IV vs salt
| Value | Main role | Key requirement |
|---|---|---|
| Nonce | Make one operation unique or bind one protocol step | Usually unique per key or session; sometimes unpredictable |
| Initialization vector (IV) | Initialize a cipher mode before encryption or decryption | Mode-specific: may need uniqueness, randomness, or unpredictability |
| Salt | Make password hashing or key derivation outputs distinct | Unique per stored secret; not a replay counter |
An IV is tied to a cipher mode. A nonce is tied to a one-time-use rule. In many modern AEAD APIs, the parameter called nonce acts as the mode's IV, but older APIs may call similar inputs iv, initializationVector, or counter.
Replay protection patterns
Nonces also protect protocols that do not necessarily encrypt data. A server can issue a challenge nonce, require the client to sign or MAC it, and then reject the same challenge if it appears again. Message-oriented systems often use monotonically increasing nonces or sequence numbers so receivers can detect duplicates and out-of-order replays.
OIDC has its own nonce concept for binding ID tokens to login attempts. CSP has a separate CSP nonce model for script allowlisting. Both inherit the same one-time-value idea, but their threat models and validation rules are different from AEAD encryption nonces.
Implementation checklist
- Read the nonce requirements for the exact algorithm or protocol before choosing random bytes or counters.
- Maintain nonce uniqueness within the scope that matters, usually per key, per session, or per response.
- Use a CSPRNG when the nonce must be unpredictable.
- Use durable counters or key rotation when counter nonces might reset after restart.
- Treat AEAD nonce reuse under one key as a severe incident, not a harmless duplicate.
- Transmit public nonces alongside ciphertext when the receiver needs them.
- Do not substitute nonce freshness for authentication, authorization, or input validation.
- Monitor systems that generate high volumes of nonces for collision risk and counter exhaustion.
The practical takeaway
A nonce is a one-time cryptographic value. It may be random, counter-based, or protocol-derived, but it must satisfy the uniqueness and unpredictability rules of the system using it.
For AEAD encryption, repeated nonces under the same key can destroy security. For protocols, nonces help bind messages to a live session and make replayed data visible. Design nonce generation deliberately, document the scope where reuse is forbidden, and rotate keys before that scope becomes hard to enforce.
Related security terms
Initialization Vector (IV)
A per-encryption input that may overlap with nonce behavior depending on the mode.
AEAD
Authenticated encryption modes that commonly require nonce uniqueness under a key.
CSPRNG
A secure random generator often used when nonces must be unpredictable.
ChaCha20-Poly1305
An AEAD cipher where nonce reuse with the same key can be catastrophic.
CSP Nonce
A web security use of nonce for per-response script allowlisting.
OIDC `nonce`
An identity-protocol nonce that binds an ID token to a login attempt.
Frequently asked questions
What is a nonce in simple terms?
A nonce is a value meant to be used once. In cryptography, that one-time value can keep encrypted messages distinct, bind protocol steps together, or make replayed data easy to reject.
Does a nonce need to be random?
Not always. Some algorithms only require uniqueness, so a counter can work if it never repeats under the same key. Other protocols require unpredictability, so use a cryptographically secure random value.
What happens if an AEAD nonce is reused?
Reusing a nonce with the same AEAD key can reveal relationships between plaintexts and may allow authentication forgery. Treat nonce reuse in modes like AES-GCM and ChaCha20-Poly1305 as a serious cryptographic failure.
Is a nonce the same as an IV?
They overlap but are not identical. An IV is an initialization input for a cipher mode; a nonce is a one-time value. Some IVs are nonces, but IV requirements vary by mode.
How do nonces stop replay attacks?
Protocols can store or derive expected nonces per session, challenge, or message number. If an attacker resends an old message with an already-seen nonce, the receiver rejects it.
Can I generate nonces with Math.random?
No for security-sensitive random nonces. Use an operating-system CSPRNG or a vetted crypto library. For counter nonces, use a design that cannot reset or collide under the same key.
Can nonce values be public?
Usually yes. Most cryptographic nonces are not secret, but their uniqueness or unpredictability still matters. Do not rely on hiding a nonce to compensate for weak generation.
References
Explore authoritative guidance and frameworks related to nonce.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.