New answers tagged


Yes, you can chain the nonces as you described, if {}K is a secure pseudo-random function such as HMAC. If you use HMAC, keyed with K, as your function on the nonces (H_K(N_n)), an attacker can not predict the nonces as he would be able to selectively forge HMAC tags as well, which is impossible even if you use HMAC-MD5 (while MD5 itself is severely broken, ...

Top 50 recent answers are included