2 ms·
> You shouldn’t rely on these claims, because even 1 bit of bias on a 256 bit nonce value can be enough to attack certain cryptographic schemes! This seems lik
by tarakat 4y ago
> You shouldn’t rely on these claims, because even 1 bit of bias on a 256 bit nonce value can be enough to attack certain cryptographic schemes!
This seems like a very high bar for a random generator to clear. It also raises a question: would using a larger nonce size actually increase risk, if the additional bits were biased?
- barsonme 4y agoWith some schemes, like ECDSA, you can't use a larger nonce since the nonce is a field element. In general, you shouldn't need to worry about it unless you're using a broken CSPRNG or a bad cryptography library. And some libraries will try and work around bad RNGs: https://cs.opensource.google/go/go/+/refs/tags/go1.19.1:src/crypto/ecdsa/ecdsa.go;l=240 https://cs.opensource.google/go/go/+/refs/tags/go1.19.1:src/...
- jstanley 4y agoIt seems like the general case answer is "no, using a larger nonce does not increase risk". Otherwise an attacker could just imagine that instead of a 256-bit nonce, the nonce was actually 257 bits long but the first bit is always 0.