XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay attack. In this scenario:

Is it better to XOR the nonce with the plain text and then encrypted the output to produce a cipher? Or XOR the nonce with the output cipher produced by encrypting the plain text? Which one would be more secure?



In my opinion, scheme 1- XORing the nonce with plain text and then encrypting the output seems to be a better option as it would produce a different cipher every time even if the plain text remains the same. Moreover, since the (nonce XOR plain text) goes through the permutation and substitution operations, the information about the nonce remains more secret. On the other hand, scheme 2 seems to be relatively less secure as the output (nonce XOR cipher) might give away some information about the generation of nonce (or about the PRNG or CSPRNG) if the attacker is able to collect enough cipher texts.

What do you think is the better way?
option 2 is insecure. Recall the nonce is public and must be sent with the ciphertext, which means it can be removed from the ciphertext trivially and therefor has no effect at all.
You are effectively doing ECB with some useless extra step and extra communication.