Re: [Cfrg] how to guard against VM rollbacks

["Hal Finney" <hal.finney at gmail.com>]

On 1/10/07, Wei Dai <weidai at weidai.com> wrote:
> If random nonces are used, care must still be taken to guard against rollbacks. At a minimum, the nonce must be randomly generated *after* the message to be encrypted and/or authenticated has been fixed. This way, if nonce reuse occurs due to a rollback, it will be reused only with the same message that it was used with previously, which should be safe.

Even with a random nonce there could be duplication if the OS RNG
state does not get changed from the time the rollback occurs until the
RNG is queried for the nonce. (Here I am assuming that the RNG is part
of the virtualized OS and not a global resource.) Note that some RNGs
buffer entropy and do not add it to the main RNG state until a certain
amount of estimated entropy has been acquired, to avoid state
following attacks. That will increase the window of vulnerability to
this problem. Nonce duplication could be avoided by creating the nonce
as a hash of RNG data and the message being hashed, to achieve the
condition that nonce reuse would only happen with the same message.

This issue could especially be a problem for counter mode encryption,
where reuse of the counter initial value will largely destroy secrecy
guarantees. Something like CBC tends to be more robust to IV reuse and
still gives you an ECB-like level of security when it happens.

Hal Finney

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg