Nonce operation advice

[temoto]

Sorry if this generic crypto question is out of scope.

What nonce operation mode would you suggest for a stateful message exchange protocol built on top of secretbox? I can imagine at least two options:

• generate random nonce in every message, send length and nonce in authenticated clear text
• hello message as above with another secret nonce in payload, derive all next nonces from that secret payload, send only authenticated length in clear text

My use case is RPC with messages around 50-200 bytes on expensive 3g network, and shaving 24 bytes from each message is definitely worth pursuing.

Thanks for your time.

[kevinburke]

Hey, oh gosh, I don't really know, unfortunately. In theory I think any system that ensures nonces don't repeat is sufficient.

[temoto]

Thank you. I've decided to go TLS route in the end because not feeling confident with custom crypto.