Problem - Kevin Tafuro

the lifetime of the key; the counter ensures that the nonce is always unique. In such a
nonce, the random part is said to be a “salt.” Generally, it’s good to have four or
more bytes of salt in a nonce.
If you decide to use only a random nonce, remember that the nonce needs to be
changed after each message, and you lose the ability to prevent against capturereplay
attacks.
The random portion of a nonce can be generated using the techniques discussed in
Chapter 11. Generally, you will have a fixed-size buffer into which you place the
nonce, and you will then set the remaining bytes to zero, incrementing them after
each message is sent. For example, if you have a 16-byte nonce with an 8-byte
counter in the least significant bytes, you might use the following code:
/* This assumes a 16-byte nonce where the last 8 bytes represent the counter! */
void increment_nonce(unsigned char *nonce) {
if (!++nonce[15]) if (!++nonce[14]) if (!++nonce[13]) if (!++nonce[12])
if (!++nonce[11]) if (!++nonce[10]) if (!++nonce[9]) if (!++nonce[8]) {
/* If you get here, you're out of nonces. This really shouldn't happen
* with an 8-byte nonce, so often you'll see: if (!++nonce[9]) ++nonce[8];
*/
}
}
Note that the this code can be more efficient if we do a 32-bit increment, but then
there are endian-ness issues that make portability more difficult.
If sequential nonces are implemented correctly, they can help thwart
capture relay attacks (see Recipe 6.1).
Initialization vectors (IVs)
The term initialization vector (IV) is the most widely used and abused of the three
terms we’ve been discussing. IV and nonce are often used interchangeably. However,
a careful definition does differentiate between these two concepts. For our purposes,
an IV is a nonce with an additional requirement: it must be selected in a
nonpredictable way. That is, the IV can’t be sequential; it must be random. One popular
example in which a real IV is required for maximizing security is when using the
CBC encryption mode (see Recipe 5.6).
The big downside to an IV, as compared to a nonce, is that an IV does not afford
protection against capture-replay attacks—unless you’re willing to remember every
IV that has ever been used, which is not a good solution. To ensure protection
against such attacks when using an IV, the higher-level protocol must have its own
notion of sequence numbers that get checked in order.
Using Salts, Nonces, and Initialization Vectors | 135
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.