2 ms·

> With GCM, incrementing the counter is done in the library and not exposed for you to forget. GCM has two counters, the message-block-counter (4 bytes), and t

> With GCM, incrementing the counter is done in the library and not exposed for you to forget. GCM has two counters, the message-block-counter (4 bytes), and the message counter / nonce (12 bytes). The former is inside the crypto library, the latter is supplied by the client and can be mismanaged like any other IV.

flatiron 5y ago
isn't this what happened to the ps3? the documentation said "use a random number" and they calculated it once and put it as a constant instead of...yah know...using a random number (each time)?
- alexeldeib 5y ago
  https://xkcd.com/221/ https://xkcd.com/221/
- deleted 5y ago
  [deleted]
- feb 5y ago
  In the PS3 they lacked a real random number in ECSDA computation. That effectively broke the signature and actually made it possible to recover the private key. For more info see for example: * https://www.cs.uaf.edu/2012/fall/cs441/students/sc_ps3.pdf https://www.cs.uaf.edu/2012/fall/cs441/students/sc_ps3.pdf * A presentation at CCC about how hackers broke the different security features or PS3 including ECDSA https://media.ccc.de/v/27c3-4087-en-console_hacking_2010#t=2112 https://media.ccc.de/v/27c3-4087-en-console_hacking_2010#t=2...