Skip to content
AI Security

Interview question · Cryptography, PKI & TLS

Why is authenticated encryption the default, and what does nonce reuse break?

Encryption without integrity has been exploited for decades. Nonce reuse under GCM is worse than most candidates think: it breaks integrity too.

mediumEssentialNewPreparation tags: Google, Amazon, AppleUpdated Nov 2026

Encryption without integrity has been exploited for decades. Nonce reuse under GCM is worse than most candidates think: it breaks integrity too.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A service encrypts records with AES-GCM using one key and a 96-bit nonce generated from a counter stored in Redis, which was recently restored from a backup.

  1. Why use AEAD rather than plain encryption?
  2. What is the nonce rule?
  3. Why is the Redis restore a problem?
  4. How would you avoid nonce reuse?
  5. What do you do about records already encrypted?
  6. How would you fix the design?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackDesign key management with envelope encryption and a KMS for a multi-tenant service.Next in this trackDesign mutual TLS between internal services. How does its trust model differ from the web PKI?Next in this trackWhat problem does Certificate Transparency solve, and how would you use it defensively?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.