Cryptographic Nonce
An arbitrary number or byte string intended to be used only once within a cryptographic communication to protect against replay attacks and ensure encryption uniqueness.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
The term "nonce" stands for "number used once". In authenticated symmetric encryption modes like AES-GCM, the nonce acts as the Initialization Vector (IV). Reusing an IV with the same AES key completely compromises the authentication tag and can leak the underlying Galois hash key. In web security, nonces are also generated per HTTP response and embedded into Content Security Policy (CSP) headers so that only inline scripts matching the exact nonce value are permitted to execute, thwarting injection attacks.
Technical Example & Practical Implementation
Two core applications of cryptographic nonces in web development
<!-- Application 1: Content Security Policy Script Whitelisting -->
<!-- HTTP Response Header: -->
Content-Security-Policy: script-src 'nonce-edg893r439fh8' 'self';
<!-- Valid script executed: -->
<script nonce="edg893r439fh8">
console.log("Authorized application code running");
</script>
<!-- Injected attacker script blocked: -->
<script>
alert("Blocked: missing nonce!");
</script>Related Topic Ecosystem & Next Steps
Verwandte Fachartikel
What Is HTTP (Hypertext Transfer Protocol)?
Foundational stateless request-response protocol of the World Wide Web.
HTTP/1.1 vs HTTP/2: Multiplexing & Performance
Head-of-line blocking compared to binary framing and stream multiplexing.
Troubleshooting: HTTP 403 Forbidden Error
Diagnose server authorization denial, WAF IP blocks, and permission issues.
Praxis-Diagnoselabore
Entwickler-Spezifikationen & Referenzen
Weiterlernen
HTTP Protocol & Header Inspection Lab
Craft raw HTTP headers and observe conditional 304 responses in the interactive workbench.