THE NONCE — a dart

THE NONCE number used once — reuse it and the whole thing unravels

A nonce is a number used once: a value you must never repeat under the same key. It sounds like bookkeeping, but it is load-bearing. Reuse a one-time-pad keystream on two messages and their XOR spills the secret: (m₁ ⊕ k) ⊕ (m₂ ⊕ k) = m₁ ⊕ m₂ — the key cancels, leaving a relation an attacker can unravel with no key at all. The same fatal reuse breaks stream ciphers, nonce-reuse in AES-GCM, and repeated k in ECDSA signatures (which leaked Sony’s PS3 key). This dart is the batch’s warning: the strongest cipher dies to a repeated number.

THE TECHNIQUE key reuse ⇒ c₁ ⊕ c₂ = m₁ ⊕ m₂ — the key cancels out

The demo enciphers two messages with the same key, then XORs the ciphertexts — the key vanishes and m₁⊕m₂ falls out: live demo

HISTORY & CREDIT nonce reuse · two-time-pad attack

“A nonce is just a counter, no big deal.” — repeat one and the key cancels; the two-time pad has leaked secrets for a century. cited

the cancel · c₁ ⊕ c₂ = (m₁ ⊕ k) ⊕ (m₂ ⊕ k) = m₁ ⊕ m₂ — the shared key disappears.
the real breaks · keystream reuse, AES-GCM nonce reuse, repeated ECDSA k (Sony PS3, 2010).
the rule · a nonce must be unique per key — often unique, sometimes also unpredictable.

A single repeated number and the key falls out of the math — the once in “used once” is the whole security. uniqueness

RECOMMEND FOR I-13 the two-time-pad leak, on the compiler

On the canonical compiler, two messages under key 42 give ciphertexts 103 and 114; their XOR is 21 — exactly m₁⊕m₂, no key needed:

$ i13 run zd_nonce.i13 # reuse key 42 on m1=77, m2=88 RUN OK · 24 step(s) · peak stack 3 · call depth 0 c1 = 103 c2 = 114 leaked = 21 -- c1 ^ c2 equals_m1_xor_m2 = 1 -- = 77 ^ 88, the key cancelled

Recommend as a NULL — a security principle, not a mechanism invariant. The nonce dart demonstrates a vulnerability (key reuse cancels via XOR’s self-inverse) rather than instantiating a corpus axis: it is the failure mode of dart 422/423, and the underlying algebra is the seated self-inverse. There is no new output-relation here to seat. i13 grounds the leak (c₁⊕c₂ = m₁⊕m₂). NULL — the batch’s cautionary tale, and a clean use of axis 1 to show why once means once.