Subject: RE: [Cfrg] how to guard against VM rollbacks

From: "Wei Dai" <[email-masked]>
Date: Fri, 2 Feb 2007 00:54:09 +0800

Peter wrote: 
> Several *theoretical* suggestions have been posted.  I haven't really
> seen
> anything that'll work in practice.

There have been several specific and practical suggestions, but they were
spread over several messages in the discussion. I'll summarize here:

1. Use random IVs instead of counter or state-derived IVs.

2. For any crypto scheme that uses random numbers or IVs, generate the
random numbers/IVs after the message to be encrypted and/or authenticated is
fixed.

3. Use the operating system's secure RNG to generate these random
numbers/IVs and hash in the current time and/or the message to make sure
random numbers are not reused on different messages.

4. As an alternative to 1-3 above, switch to a crypto scheme such as SIV
that is specifically designed to tolerate nonce reuse.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg