nonce

[landabaso]

Could you please explain how is the nonce created? Can it be passed?

I understand that when using random nonces, there is some risk of collision?

[landabaso]

I went through the sources for iOS (I guess it's the same in Android?) and I believe that a random nonce is being produced.

This may lead into issues. See this discussion.

Would you consider letting the user pass the nonce? There are some interesting alternatives in the literature.

[hayr-hotoca]

For most users who are not cryptography experts, relying on proven cryptographic libraries like iOS's ChaChaPoly (https://developer.apple.com/documentation/cryptokit/chachapoly) and Android's Tink (https://developers.google.com/tink) is a safer approach. These libraries take care of the complex details, ensuring secure encryption and decryption.

For example, with the 1LimX app being offline, It's highly unlikely to experience a nonce collision, regardless of how much data a single user encrypts. A unique 256-bit encryption key and 2^96 possible nonces are more than sufficient for one person.

However, in situations where users require more functionality than the original library offers, creating a fork and making custom implementations is an option. For now, using the proven libraries provided by Apple and Google remains the safer choice.

I hope this is helpful!

[landabaso]

Thanks for your reply. In case you are interested, libsodium has an implementation of the extended version of chachapoly (xchacha20poly), that addresses this issue using 192-bit nonces and is considered to be safe to use with randomly-generated nonces. There is also a react-native implementation. It may be something interesting to explore and make your product even better. Thanks for providing this package and for your work.