{"id":14990832,"url":"https://github.com/jedisct1/nonce-extension","last_synced_at":"2025-04-12T03:24:30.696Z","repository":{"id":205079216,"uuid":"713368841","full_name":"jedisct1/nonce-extension","owner":"jedisct1","description":"Make AES-GCM safe to use with random nonces, for any practical number of messages.","archived":false,"fork":false,"pushed_at":"2024-03-28T22:45:27.000Z","size":17,"stargazers_count":18,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-25T23:01:38.681Z","etag":null,"topics":["aes","aes-gcm","derive-key-aes-gcm","dndk-gcm","double-nonce-derive-key-aes-gcm","extension","nonce","zig"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jedisct1.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-02T11:33:52.000Z","updated_at":"2024-10-27T20:38:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"c6953ca5-0952-4a49-8081-fc5892bae12a","html_url":"https://github.com/jedisct1/nonce-extension","commit_stats":{"total_commits":15,"total_committers":1,"mean_commits":15.0,"dds":0.0,"last_synced_commit":"a6927c79969f2afd01637923b2083037e54b3117"},"previous_names":["jedisct1/zig-nonce-extension"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fnonce-extension","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fnonce-extension/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fnonce-extension/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fnonce-extension/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jedisct1","download_url":"https://codeload.github.com/jedisct1/nonce-extension/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248511066,"owners_count":21116345,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aes","aes-gcm","derive-key-aes-gcm","dndk-gcm","double-nonce-derive-key-aes-gcm","extension","nonce","zig"],"created_at":"2024-09-24T14:20:56.172Z","updated_at":"2025-04-12T03:24:30.677Z","avatar_url":"https://github.com/jedisct1.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Derive-Key-AES-GCM\n\nAES-GCM is a very common choice of authenticated encryption algorithm.\n\nUnfortunately, it has some [pretty low usage limits](https://datatracker.ietf.org/doc/draft-irtf-cfrg-aead-limits/).\n\nUsing it with a large amount of messages requires extra care to ensure that nonces never repeat, and that keys are frequently rotated.\n\nThe TLS protocol hides that complexity, but applications using AES-GCM directly need to be aware of these limitations in order to use AES-GCM safely.\n\nIdeally, nonces should be large, allowing applications to safely generate them randomly, with a negligible collision probability. But AES-GCM, as commonly implemented and required by IETF protocols, is limited to 96-bit (12 bytes) nonces, which is not enough to avoid collisions. AES-GCM keys are also expected to be replaced way before 2^32 messages have been encrypted.\n\nDuring the 2023 NIST Workshop on Block Ciphers, Shay Gueron presented a clever way to overcome these limitations, and extend a key lifetime to \"forever\": the [Derive-Key-AES-GCM](https://csrc.nist.gov/csrc/media/Presentations/2023/constructions-based-on-the-aes-round/images-media/sess-5-gueron-bcm-workshop-2023.pdf) construction.\n\nThis construction allows larger nonces to be used with AES-GCM, thus extending the key lifetime. With AES-256 and 192-bit nonces, a practically unlimited number of messages can be encrypted using a single key, and with nonces that can be randomly generated.\n\nIt significantly improves the safety of AES-GCM with minor overhead.\n\nWhen instantiated with `AES-128`, the `Derive-Key` construction derives a fresh `AES-128` encryption key from a key and a nonce that can be up to 120 bits (theorically 126, but 120 for practical purposes). That encryption key can then be used with `AES-128-GCM`, along with a static nonce.\n\nWhen instantiated with `AES-256`, the `Double-Nonce-Derive-Key` construction derives a fresh `AES-256` encryption key from a key and a nonce that can be up to 232 bits (but 192 is enough for all practical purposes). That encryption key can then be used with `AES-128-GCM`, along with a static nonce, and the guarantee that keys will never repeat.\n\nThis repository contains easy-to-use implementations of these constructions (`aes256-gcm-dndk`, `aes128-gcm-dndk`).","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjedisct1%2Fnonce-extension","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjedisct1%2Fnonce-extension","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjedisct1%2Fnonce-extension/lists"}