nonce

A nonce is a value used only once in cryptographic or security protocols to prevent replay attacks and ensure freshness of a communication or operation. The term is often interpreted as “number used once,” and a nonce can be random, pseudorandom, or derived from a timestamp or counter. In practice, nonces are combined with messages, keys, or challenges to produce unique inputs for cryptographic functions such as hashes, message authentication codes, or digital signatures.

Common applications include authentication and key exchange, where a server issues a nonce to a client as part of a challenge-response protocol. The client’s response proves knowledge of a secret without reusing previous conversations, and the server verifies the response using the nonce. In digital signatures, nonces help prevent replay of signed data; some schemes require a unique nonce per signing operation, and reusing a nonce with the same key can compromise the private key in certain algorithms.

In web and network protocols, nonces are used to guard against replay attacks in authentication schemes such as HTTP Digest and various API token flows. In blockchain and cryptocurrency systems that use proof of work, miners search for a nonce value that, when included in the block header and hashed, yields a hash below a target threshold, thereby producing a valid block.

Security considerations include ensuring a nonce is unique for a given key and purpose, unpredictability where required, and avoiding reuse. Etymology traces to the phrase “number used once,” distinct from unrelated uses of the term in other contexts.