Re: [Cfrg] Request For Comments: OCB Internet-Draft

["Rose, Greg" <[e-mail]>]

On 2011 Jul 15, at 10:38 , Jack Lloyd wrote:

> On Fri, Jul 15, 2011 at 09:45:06AM -0700, Ted Krovetz wrote:
> 
>> In my opinion the point of the nonce-reuse warning is to impress
>> upon security engineers that catastrophe strikes if a nonce is
>> reused during encryption, and so they should make nonce reuse
>> impossible. If nonce reuse is impossible, then it is irrelevant how
>> bad the damage is when nonces are reused.
> 
> I think part of the issue is that making something truly 'impossible'
> is quite a bit harder than it might sound, especially in the face of
> an active attacker who might well decide that the easiest way of
> breaking the system is to force it to reuse a nonce somehow (this
> seems especially likely in embedded systems, but a general system
> might well be susceptible). Some plausible failure modes, like VM
> state rollback [1], could even be attacked passively and
> opportunistically.
> 
> Someone building or deploying a system (ie the sort of person who
> would read an i-d or RFC) might well want to understand exactly how
> fragile the system is when misused, which lets them make a realistic
> and informed judgement of the tradeoffs in choosing between different
> options.

And don't forget that the attacker gets to reuse nonces all he wants (albeit on presumably invalid packets). This is why there must be an absolute prohibition on using the decryption results of an invalid packet. I haven't had time to read the draft; I trust this is mentioned somewhere. It's particularly important for a mode like OCB where the decryption is already done before you know that the packet was bogus. The data should be cleared before returning failure.

Greg.