[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Cfrg] consequences of nonce reuse



Marshall:

There are several instances where nonces are counters that start with zero. This allows the same value to provide the cryptographic protection and to provide replay detection. This is the use in IEEE 802.11i, where a fresh key is established with each new 802.11 association, preventing the concerns discussed on this thread.

Russ

At 05:50 AM 1/7/2007, Marshall Eubanks wrote:
In the light of this discussion, wouldn't it make sense to require
that a NONCE used in a cryptographic context be either

- a counter concatenated  or hashed with a random number or
- a counter that is always reset to a random value, or
- a random number itself ?

While random number generation in a computer may have its problems, in
this case, the only goal is to make the probability of reuse very
small, which it should be possible to achieve.

Regards
Marshall Eubanks

On 1/7/07, Wei Dai <weidai11 at gmail.com> wrote:
On 4 Jan 2007 15:31:42 -0000, D. J. Bernstein <djb at cr.yp.to> wrote:
> What exactly is the cost that you're referring to? Do you think that the
> encrypted-TCP server (or client) has trouble counting 1, 2, 3, ...?

If you want to maintain a count across reboots, you have to write the
counter to disk. Then you'd have to worry about file system security,
detecting when the disk might have been restored from an earlier backup,
etc. I'd bet there are very few applications that do this securely. Most
applications that use counters probably don't bother to save them, and
instead, upon reboot either set their counters to random values or discard
all shared symmetric keys and re-establish them (in which case random nonces
are probably used as part of of the key agreement protocols).

Besides reboots, we now also have the possibility of our software running
inside virtual machines (e.g. VMware), where even volatile memory can be
rolled back to earlier checkpoints.

> You might say that your PRF(hash,"nonce") isn't PRF(hash,constant), and
> that your "nonces" aren't likely to collide when the hashes do, but if
> you think that the nonce generator is too stupid to count 1, 2, 3, ...
> then I don't see how you can "guarantee" anything about the frequency of
> nonce collisions.
>

Perhaps from a theoretical perspective generating random numbers is much
harder than counting, but from a practical perspective, in many situations
random number generation is a solved problem whereas counting isn't. Modern
operating systems provide facilities to easily generate random numbers of
cryptographic quality. I think the above discussion implies that OS support
is also needed to easily maintain a count of cryptographic quality, but this
support isn't available yet.


_______________________________________________ Cfrg mailing list Cfrg at ietf.org https://www1.ietf.org/mailman/listinfo/cfrg



_______________________________________________ Cfrg mailing list Cfrg at ietf.org https://www1.ietf.org/mailman/listinfo/cfrg



_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg