4 ms·
> the best way to generate a unique nonce is as a hash of the input message - otherwise you technically have to record every nonce you’ve ever used. That doesn
by admax88q 8y ago
> the best way to generate a unique nonce is as a hash of the input message - otherwise you technically have to record every nonce you’ve ever used.
That doesn't sound right.
I would wager that using a cryptographically secure RNG is less likely to produce the same number twice, or at the very least equally as likely. If you have a very strong hash, then the hash algorithm should act the same as an RNG.
- metalliqaz 8y agoYou are supposed to combine the hash with the user-provided nonce. It's not purely a hash, that's not good enough. The purpose is to protect against the user-provided nonce being weak. Still expect a proper nonce if it can be done.
- olliej 8y agoThe problem with gcm is that you absolutely cannot ever reuse a nonce, hence gcm-siv using a hash of the message - assuming a cryptographically strong hash the hash collision rate should theoretically have lower odds than a pure ring (sqrt(hashsize) vs likelihood of non-random different data colliding in practice) Of course all of this is on the assumption that any hashes and rngs you use are secure :) In practice: many sites using gcm were using rng based nonces that end up colliding
- admax88q 8y agoI get why 'SIV' used a hash of the message in addition to the user provided nonce. My point was I disagree on your sentence "the best way to generate a unique nonce is as a hash of the input message - otherwise you technically have to record every nonce you’ve ever used." That implies that a hash is strong enough that you don't need to track messages. If you believe that to be the case then a CSRNG would be equally as strong of not stronger and less complex. Still sqrt(n) chance of collision.