Re:This working group has failed
by bodyfour on Tuesday January 07, 2014 @12:25PM
(#7018434)
If you choose a random nonce then it follows that a nonce could be randomly reused. If there are N possible nonces this will happen on average after approximately sqrt(N) packets. If you use a counter as a nonce it will only repeat after N packets, no matter what.
For some algorithms a simple incremented value is all that's needed "1, 2, 3, ..." but this means an attacker seeing only two packets can at least estimate how quickly packets are being sent. However, if you encrypt this stream of incrementing numbers with a constant symmetric key you get the best of both worlds: a nonce stream that looks random but is guaranteed not to repeat until after each possible value has been used. Usually when crypto people talk about a "counter" this is the technique they're referring to.
For some algorithms a simple incremented value is all that's needed "1, 2, 3, ..." but this means an attacker seeing only two packets can at least estimate how quickly packets are being sent. However, if you encrypt this stream of incrementing numbers with a constant symmetric key you get the best of both worlds: a nonce stream that looks random but is guaranteed not to repeat until after each possible value has been used. Usually when crypto people talk about a "counter" this is the technique they're referring to.