Problem - Kevin Tafuro

4.9 Using Salts, Nonces, and Initialization
Vectors
Problem
You want to use an algorithm that requires a salt, a nonce or an initialization vector
(IV). You need to understand the differences among these three things and figure out
how to select good specimens of each.
Solution
There’s a lot of terminology confusion, and the following “Discussion” section contains
our take on it. Basically, salts and IVs should be random, and nonces are usually
sequential, potentially with a random salt as a component, if there is room. With
sequential nonces, you need to ensure that you never repeat a single {key, nonce}
pairing.
To get good random values, use a well-seeded, cryptographically strong pseudo-random
number generator (see the appropriate recipes in Chapter 11). Using that, get
the necessary number of bits. For salt, 64 bits is sufficient. For an IV, get one of the
requisite size.
Discussion
Salts, nonces, and IVs are all one-time values used in cryptography that don’t need to
be secret, but still lead to additional security. It is generally assumed that these values
are visible to attackers, even if it is sometimes possible to hide them. At the very
least, the security of cryptographic algorithms and protocols should not depend on
the secrecy of such values.
We try to be consistent with respect to this terminology in the book.
However, in the real world, even among cryptographers there’s a lot of
inconsistency. Therefore, be sure to follow the directions in the documentation
for whatever primitive you’re using.
Salts
Salt is random data that helps protect against dictionary and other precomputation
attacks. Generally, salt is used in password-based systems and is concatenated to the
front of a password before processing. Password systems often use a one-way hash
function to turn a password into an “authenticator.” In the simplest such system, if
there were no salt, an attacker could build a dictionary of common passwords and
just look up the original password by authenticator.
Using Salts, Nonces, and Initialization Vectors | 133
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.