Problem - Kevin Tafuro

To ensure the best security, we strongly recommend that you follow these steps:
1. Select a nonce using a well-seeded cryptographic random number generator (see
Chapter 11). If you’re going to have multiple messages to process, select a random
portion that is common to all messages (at least 64 bits) and use a counter
for the rest. (The counter should be big enough to handle any possible number
of messages. Here we also recommend dedicating at least 64 bits.)
2. Determine the internal block length of the hash function (discussed later in this
section).
3. Pad the nonce to the internal block length by adding as many zero-bytes as necessary.
4. Add the padded nonce to both the beginning and the end of the message.
5. Hash, creating a value V.
6. Hash V to get the final output. This final step protects against length-extension
attacks, as discussed in Recipe 6.7.
One thing that you need to be sure to avoid is a situation in which the attacker can
control the nonce value. A nonce works well only if it cannot be reused. If an
attacker can control the nonce, he can generally guarantee it gets reused, in which
case problems like the birthday attack still apply.
In cases where having a nonce that the attacker can’t control isn’t appropriate, you
can probably live with birthday attacks if you’re using SHA1 or better. To protect
against other attacks without using a nonce, see Recipe 6.7.
All hash functions have a compression function as an element. The size to which that
function compresses is the internal block size of the function, and it is usually larger
than the actual digest value. For hash functions based on block ciphers, the internal
block size is the output length of the hash function (and the compression function is
usually built around XOR’ing multiple pieces of block-sized data). Table 6-4 lists the
internal block sizes of common message digest functions not based on block ciphers.
Table 6-4. Internal block sizes of common message digest functions
Algorithm Digest size Internal block size
MD2 128 bits 16 bytes (128 bits)
MD4 128 bits 64 bytes (512 bits)
MD5 128 bits 64 bytes (512 bits)
RIPEMD-160 160 bits 64 bytes (512 bits)
SHA1 160 bits 64 bytes (512 bits)
SHA-256 256 bits 64 bytes (512 bits)
SHA-384 384 bits 128 bytes (1,024 bits)
SHA-512 512 bits 128 bytes (1,024 bits)
Using a Nonce to Protect Against Birthday Attacks | 271
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.