11 ms·
This is freaking fantastic- I only wish it existed when I wrote my last encrypted filesystem a few years back. Nonce collision is a huge concern on large file
by convivialdingo 2y ago
This is freaking fantastic- I only wish it existed when I wrote my last encrypted filesystem a few years back.
Nonce collision is a huge concern on large file system deployments. 2^32 seems huge but when you’re writing 100k iops a second on a PB array the chance of collision is almost guaranteed if you’re betting on PRNG randomness.
- deleted 2y ago[deleted]
- tremon 2y agoWhy is nonce collision a problem though? It just means that two blocks share the same encryption key, right? Without knowing the plaintext in either block, how does that weaken the security of the system?
- dchest 2y agoEncryption with the same key and repeated nonce/counter produce the same cipher stream. Ciphertext in GCM (or CTR) mode is cipherstream XOR plaintext, thus given two ciphertexts with the same key/nonce: ciphertext1 XOR ciphertext2 = (cipherstream XOR plaintext1) XOR (cipherstream XOR plaintext2) = plaintext1 XOR plaintext2 In GCM it can also break authentication.
- notfed 2y agoThe CAESAR competition [1] ended in 2019 and resulted in multiple different AEADs, most with plenty of nonce space. [1] https://en.m.wikipedia.org/wiki/CAESAR_Competition https://en.m.wikipedia.org/wiki/CAESAR_Competition