Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

["Scott Fluhrer (sfluhrer)" <[e-mail]>]

>  -----Original Message-----
> From: Cfrg [mailto:[e-mail]] On Behalf Of Jonathan Berliner
> Sent: Thursday, November 20, 2014 11:25 AM
> To: Watson Ladd
> Cc: [e-mail]
> Subject: Re: [Cfrg] Proposed Informational Note: Security Guidelines for
> Cryptographic Algorithms in the W3C Web Cryptography API
> 
> I'm relatively new to this group so take this with some salt, but this bothered
> me:
> 
> I don't like the usage of "nonce" and "random" in these sentences:
> "AES-CBC mode is not CCA secure. It is secure against chosen plaintext
> attacks (CPA-secure) if the IV is random, but not if the IV is a
> nonce[rogaway11evaluation]."
> 
> "AES-CFB is not CCA secure. It is CPA-secure if the IV is random, but not if the
> IV is a nonce [rogaway11evaluation]."
> 
> I read Rogaway's paper
> (http://web.cs.ucdavis.edu/~rogaway/papers/modes.pdf), but I think we
> can define this better:
> 
> "Nonce" - a value/number/string used only once.
> "Random number" - a value/number/string that doesn't follow a pattern (or
> what-have-you).
> 
> This doesn't mean that "nonces" are insecure. "Non-random nonces" are
> insecure, but "random nonces" are secure.

I don't think that Rogaway wants to imply that using nonces necessarily imply insecurity; instead, what he is saying is that if we assume that we use nonces (and make no other assumption beyond that), that does not imply security.  That is, we're not looking for things we know will lead to weakness; we're looking for the necessary assumptions we need to make to know that the cryptography is strong.

> According to the flow of the
> document, "random IVs" are also insecure, because they may be used more
> than once.

Actually, if the IV's are actually chosen at random, we can show that the probability of selecting the same IV twice is negligible.

> 
> I think I understood Rogaway's intent here, that non-randomness is the
> problem, not one-timeness. Based on a cursory survey of parlance used on
> the Internet, I think others would be confused by this, because "nonces" can
> also be "random."

Just because others use terminology is an imprecise way doesn't mean we should.