Re: [Cfrg] Request For Comments: OCB Internet-Draft

[Jack Lloyd <[e-mail]>]

On Fri, Jul 15, 2011 at 09:45:06AM -0700, Ted Krovetz wrote:

> In my opinion the point of the nonce-reuse warning is to impress
> upon security engineers that catastrophe strikes if a nonce is
> reused during encryption, and so they should make nonce reuse
> impossible. If nonce reuse is impossible, then it is irrelevant how
> bad the damage is when nonces are reused.

I think part of the issue is that making something truly 'impossible'
is quite a bit harder than it might sound, especially in the face of
an active attacker who might well decide that the easiest way of
breaking the system is to force it to reuse a nonce somehow (this
seems especially likely in embedded systems, but a general system
might well be susceptible). Some plausible failure modes, like VM
state rollback [1], could even be attacked passively and
opportunistically.

Someone building or deploying a system (ie the sort of person who
would read an i-d or RFC) might well want to understand exactly how
fragile the system is when misused, which lets them make a realistic
and informed judgement of the tradeoffs in choosing between different
options.

Regards,
  Jack

[1] http://www.ietf.org/mail-archive/web/cfrg/current/msg01349.html