Nonce Generators and the Nonce Reset Problem

Erik Zenner

    Research output: Chapter in Book/Report/Conference proceedingArticle in proceedingsResearchpeer-review

    Abstract

    A nonce is a cryptographic input value which must never repeat within a given context. Nonces are important for the security of many cryptographic building blocks, such as stream ciphers, block cipher modes of operation, and message authentication codes. Nonetheless, the correct generation of nonces is rarely discussed in the cryptographic literature. In this paper, we collect a number of nonce generators and describe their cryptographic properties. In particular, we derive upper bounds on the nonce collision probabilities of nonces that involve a random component, and lower bounds on the resulting nonce lengths. We also discuss an important practical vulnerability of nonce-based systems, namely the nonce reset problem. While ensuring that nonces never repeat is trivial in theory, practical systems can suffer from accidental or even malicious resets which can wipe out the nonce generators current state. After describing this problem, we compare the resistance of the nonce generators described to nonce resets by again giving formal bounds on collision probabilities and nonce lengths. The main purpose of this paper is to provide a help for system designers who have to choose a suitable nonce generator for their application. Thus, we conclude by giving recommendations indicating the most suitable nonce generators for certain applications.
    Original languageEnglish
    Title of host publicationProceedings ISC 2009
    EditorsP. Samarati
    PublisherSpringer
    Publication date2009
    Pages411-426
    Publication statusPublished - 2009
    EventInformation Security Conference - Pisa, Italy
    Duration: 1 Jan 2009 → …

    Conference

    ConferenceInformation Security Conference
    CityPisa, Italy
    Period01/01/2009 → …
    SeriesLecture Notes in Computer Science
    Number5735

    Fingerprint Dive into the research topics of 'Nonce Generators and the Nonce Reset Problem'. Together they form a unique fingerprint.

    Cite this