Subject: Re: [Cfrg] consequences of nonce reuse

From: [email-masked] (Peter Gutmann)
Date: Mon, 08 Jan 2007 01:20:40 +1300

Ben Laurie <[email-masked]> writes:
>Peter Gutmann wrote:
>> "Wei Dai" <[email-masked]> writes:
>>
>>> I'd like to request that designers of nonce-based crypto schemes include an
>>> analysis of the security consequences of nonce reused when proposing their
>>> schemes.
>>
>> Seconded.  In addition designers should make clear whether a nonce should be:
>>
>> - Nonrepeating (so a counter will do).
>> - High-entropy (a hash of the counter will do).
>
>You mean a secret-key HMAC, surely?

If I'd meant that, I would have said it :-).  What I meant was unstructured
data (i.e. not 127 zero bits followed by a one bit as for a counter), but not
necessarily unpredictable.

>> - Unpredictable (requiring a truly random value).
>
>How is "truly random" different from a secret-key HMAC of a counter? 

It isn't.  Note though that it differs from my definition of case 2.

Peter.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Ben Laurie <[email-masked]>
Date: Sat, 13 Jan 2007 15:27:54 +0000

I thought I'd already responded to this, but it seems the void ate it.

> necessarily unpredictable.

If it is not unpredictable, then it is not high entropy, surely? This is
why I wanted to introduce a secret key - that way an HMAC of a counter
would be high entropy.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff