Problem - Kevin Tafuro

The use of salt means that the attacker would have to produce a totally separate dictionary
for every possible salt value. If the salt is big enough, it essentially makes dictionary
attacks infeasible. However, the attacker can generally still try to guess every
password without using a stronger protocol. For a discussion of various passwordbased
authentication technologies, see Recipe 8.1.
If the salt isn’t chosen at random, certain dictionaries will be more likely than others.
For this reason, salt is generally expected to be random.
Salt can be generated using the techniques discussed in Chapter 11.
Nonces
Nonces * are bits of data often input to cryptographic protocols and algorithms,
including many message authentication codes and some encryption modes. Such values
should only be used a single time with any particular cryptographic key. In fact,
reuse generally isn’t prohibited, but the odds of reuse need to be exceptionally low.
That is, if you have a nonce that is very large compared to the number of times you
expect to use it (e.g., the nonce is 128 bits, and you don’t expect to use it more than
232 times), it is sufficient to choose nonces using a cryptographically strong pseudorandom
number generator.
Sequential nonces have a few advantages over random nonces:
• You can easily guarantee that nonces are not repeated. Note, though, that if the
possible nonce space is large, this is not a big concern.
• Many protocols already send a unique sequence number for each packet, so one
can save space in transmitted messages.
• The sequential ordering of nonces can be used to prevent replay attacks, but
only if you actually check to ensure that the nonce is always incrementing. That
is, if each message has a nonce attached to it, you can tell whether the message
came in the right order, by looking at the nonce and making sure its value is
always incrementing.
However, randomness in a nonce helps prevent against classes of attacks that amortize
work across multiple keys in the same system.
We recommend that nonces have both a random portion and a sequential portion.
Generally, the most significant bytes should be random, and the final 6 to 8 bytes
should be sequential. An 8-byte counter can accommodate 264 messages without the
counter’s repeating, which should be more than big enough for any system.
If you use both a nonce and a salt, you can select a single random part for each key
you use. The nonce on the whole has to be unique, but the salt can remain fixed for
* In the UK, “nonce” is slang for a child sex offender. However, this term is widespread in the cryptographic
world, so we use it.
134 | Chapter 4: Symmetric Cryptography Fundamentals
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.