On Mon, Jul 8, 2019 at 09:57:57PM -0600, Ryan Lambert wrote:
> Hey everyone,
>
> Here is my input regarding nonces and randomness.
>
> > As I understand it, the NIST recommendation is a 96-bit *random* nonce,
>
> I could not find that exact requirement in the NIST documents, though given the
> volume of that library it would be possible to miss. The recommendation I
> repeatedly saw for the nonce was unique. There is also an important
> distinction that the nonce is not the Initialization Vector (IV), it can be
> used as part of the IV, more on that later.
>
> The most succinct definition for nonce I found was in SP-800-38A [1] page 4:
> "A value that is only used once."
> SP-800-90A [2] (page 6) expands on the definition: "A time-varying value that
> has at most a negligible chance of repeating, e.g., a random value that is
> generated anew for each use, a timestamp, a sequence number, or some
> combination of these."
>
> The second definition references randomness but does not require it. [1] (pg
> 19) reinforces the importance of uniqueness: "A procedure should be
> established to ensure the uniqueness of the message nonces"
Yes, that is what I remembered but the URL I referenced stated
randomness is preferred. I was hopeful that whatever was preferring
randomness was trying to avoid a problem we didn't have.
> Further, knowing the nonce gets you nowhere, it isn't the salt until it is ran
> through the forward cipher with the encryption key. Even with the nonce the
> attacker has doesn't know the salt unless they steal the key, and that's a
> bigger problem.
Yes, I had forgotten about that step --- good point, meaning that the
nonce for block zero is different for every encryption key.
> The strictest definition of nonce I found was in [2] (pg 19) defining nonces to
> use in the process of random generation:
>
> "The nonce shall be either:
> a. A value with at least (security_strength/2) bits of entropy, or
> b. A value that is expected to repeat no more often than a (security_strength/
> 2)-bit random
> string would be expected to repeat."
>
> Even there it is randomness (a) or uniqueness (b).
Thanks, this was very helpful.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
