What is a cryptographic nonce and why is it used?

• A. A fixed value used in all encryptions
• B. A number used once to ensure freshness and prevent replay attacks; used in TLS to ensure unique session states
• C. A random encryption key
• D. A digital signature

Answer: (B)

A cryptographic nonce is a number used just once to guarantee freshness and prevent replay attacks. It isn’t a secret; it’s typically shared openly and may be random or unique per session. In TLS and similar protocols, each connection includes fresh nonces from both parties. Those nonces are combined with other secret material to derive unique session keys, so every session is distinct even if other values repeat. This prevents an attacker from reusing old messages or hijacking a previous session, because a message from an old session would carry a nonce that doesn’t match the current handshake.

If a fixed value were used for all encryptions, the same keystream could repeat (in certain modes), enabling leakage or manipulation of plaintext. A random encryption key is something else entirely—a secret key, not a one-time value. A digital signature is a separate mechanism for proving authenticity and integrity, not a one-time nonce.