Friends don’t let friends reuse IVs

Summary: Trail of Bits describes a bug it found in a client's threshold signature scheme using ChaCha20-Poly1305: every party initialized a global nonce counter at 0, incremented it at the same rate, and sent messages in the same order, so two different senders could use the same nonce with the same shared key. No party ever reused its own nonce, but the reuse leaked the message-authentication key and would have let a person in the middle tamper with certain messages and make honest parties appear malicious.
What's compelling: The team's mental model - never send two messages with the same nonce - passed while the actual threat, anyone sending with the same key and nonce, went unaddressed; the fix is separate directional keys per channel, as the Noise Protocol Framework requires.

Read the original at Trail of Bits Blog ↗