search

RustCrypto / traits

Collection of cryptography-related traits
592 stars 193 forks source link

aead: marker trait + simpler encryption API for randomized nonces #1666

Open tarcieri opened 2 months ago

tarcieri commented 2 months ago

We currently require an explicit nonce for all encryption APIs, including ones which automatically encode the nonce as part of the AEAD message.

For some AEADs we can use purely randomized nonces safely: AES-GCM-SIV, the XChaCha* variants, and the new XAES-256-GCM are all examples of AEAD algorithms which are safe to use with nonces derived from a CSPRNG.

For these constructions, it would be nice if we had APIs that completely delegate nonce generation to a CSPRNG so we could more easily avoid nonce reuse.

tarcieri commented 1 week ago

As discussed in #1713, the encryption API can also wrap up prepending the random nonce to the message, as is customary.

newpavlov commented 1 week ago

Are there any protocols used in practice which append nonces to ciphertext?

We potentially could add an inout type with reserved header of fixed size. It also could be useful for a more efficient set of prefix encrypt/decrypt methods.