[Rats] Re: [lamps] Re: Re: Freshness with Nonces

[Orie Steele <[e-mail]>]

I'm not Henk, and I think I shared this draft before, so apologies for
repeating it:
https://github.com/peppelinux/draft-demarco-oauth-nonce-endpoint

The goal of the draft was to explain the benefits of nonces, and nonce
strategies like random, signed or encrypted, and to define a simple
endpoint for retrieving them.

The draft is not specific to OAuth, and received a fairly cold review from
OAuth at the last IETF, because.... retrieving and using nonces is usually
something that is done in the context of a protocol, not as some abstract
building block.

In general, some challenge response flows can be made stateless by signing
or encrypting a nonce.

Then the verifier decrypts or verifies the signature, and can also validate
other claims, instead of doing database reads and writes.

You still probably want to consider rate limiting or other ddos mitigation
schemes to prevent an attacker from generating lots of expensive
cryptographic operations, in the same way you might be concerned with an
attacker finding a way to cause a verifier to store a large amount of
"pending" nonces.

Regards,

OS


On Fri, Jun 21, 2024 at 2:40 PM Muhammad Usama Sardar <
[e-mail]> wrote:

> Hi Henk,
>
> your short sentences seem to be missing some context. So I still don't
> fully understand what you are saying.
>
> On 21.06.24 12:18, Henk Birkholz wrote:
> > Hi Usama,
> >
> > you cannot check freshness or recentness.
> "with signatures alone" I guess, right?
> > But if you recognize a unique signature (and remember them in "state")
> > then you can avoid replay attacks.
> Where does this uniqueness of signature come from? The only two possible
> inputs of signature are the signing key and the data. Assuming the
> signing key remains the same, the only source of uniqueness is the data.
> And that is what I mentioned below that unless some freshness context
> (such as nonce or timestamp) is added to the signing data, how can the
> verifier check the freshness?
> > That is of course not always feasible, but if you can "remember"
> > nonces, you can also remember signatures - in the context of replay
> > attacks.
> I don't immediately see any benefit of storing signatures rather than
> nonces. Can you illustrate a few benefits?
>
> Regards,
>
> Usama
>
> >
> > On 19.06.24 21:06, Muhammad Usama Sardar wrote:
> >> Hi Henk,
> >>
> >> On 19.06.24 20:41, Henk Birkholz wrote:
> >>> for example, signatures can be used for replay attack detection,
> >>> too. I think you do not need nonces for that at all.
> >>
> >> I don't think that is correct. How can signatures /alone/ be used for
> >> /replay/ attack detection? Unless some freshness context (such as
> >> nonce or timestamp) is added to the data that is signed, you can
> >> replay it forever.
> >>
> >> Usama
> >>
>
> _______________________________________________
> RATS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>


-- 


ORIE STEELE
Chief Technology Officer
www.transmute.industries

<https://transmute.industries>