so, I want to implement server which validates registration with captcha. First I thought about storing captchas in a server, but then I thought it would be hassle on caching, memory, what if I need to write it into file, etc... But then I had this genius idea (probably someone else already did it), how about just send captcha to the client, also send the encrypted answer, and when user answers he sends the captcha (or maybe a digest of it, if it's a little bigger) and I can simply decrypt the answer out of the client. BOOM, I don't need to store bazillions of images at all and I can scale these up as much as I want! (different server could send out captcha and different could serve the response).
Now, I just have one problem. I need a nonce to encrypt stuff in libsodium. Like in here http://doc.libsodium.org/public-key_cryptography/authenticated_encryption.html . Now, if I generate this every time, send to the user for the user to send it back, then it is public, what is the point of that? Or, if I use constant nonce then, still, what is the point of that? Server and client can look it up.
What should I do here? Should I use constant nonce in this situation or should I generate it every time and why?