Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

[David Gil <[e-mail]>]

>On 20/11/2014 17:58, Scott Fluhrer (sfluhrer) wrote:
>>> From: Cfrg [mailto:[e-mail]] On Behalf Of Jonathan Berliner
>>> "AES-CFB is not CCA secure. It is CPA-secure if the IV is random, but not if the
>>> IV is a nonce [rogaway11evaluation]."
>>> [...]
>>> This doesn't mean that "nonces" are insecure. "Non-random nonces" are
>>> insecure, but "random nonces" are secure.
>> 
>> I don't think that Rogaway wants to imply that using nonces necessarily imply
>> insecurity; instead, what he is saying is that if we assume that we use
>> nonces (and make no other assumption beyond that), that does not imply
>> security.  That is, we're not looking for things we know will lead to
>> weakness; we're looking for the necessary assumptions we need to make to know
>> that the cryptography is strong.
>
> I agree, but I think the sentence quoted above would be clearer this way:
> 
> "AES-CFB is not CCA secure. It is CPA-secure if the IV is random, but it is not
> enough for the IV be be a nonce [rogaway11evaluation]."

Could we please just use the terminology that every paper on crypto uses?

Standard jargon: IVs are always uniform (computationally hard 
pseudo)random strings. Nonces are strings that are used only once.

As Watson noted, an IV of sufficient length is with high probability
a nonce; best is to set len(IV) = 2*s, where s is the target security
strength.