Hacker News Reader

Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.

View on HN

But shouldn't that bound be astronomical?

I'm fairly out of my depth here, but the birthday paradox is a harsh mistress.

Especially when the pool of possibilities is equally massive

GCM is like 4 billion messages, which is not astronomical at Facebook's scale.

Meta (we) process many billions of messages per second. Finding enough randomness is a thing at scale.

Per day? but not per second. would require every human being sending @ message every 8 seconds

Per second. Messages in the Kafka sense not the WhatsApp sense.

For a given nonce collision, how many blocks or messages can be decrypted?

For some modes, you can break every message encrypted with that key.

Reply on news.ycombinator.com