2

Server and client have a pre-shared key K. Assuming that that pre-shared key is safe, so nobody other than server/client can encrypt/decrypt.

Client sends a nonce N to server, server then sends back message M in encrypted form AES_CBC_Encrypt(M+N, K, IV) to client. So client can verify if there is a replay attack trying to send an expired message.

Is it necessary for client to send N in encrypted form AES_CBC_Encrypt(N, K, IV) or it is OK to just send N in clear.

(M and N are 16-byte array, M+N means concatenation of M and N).

6
  • Just sending "N in clear" would completely fail to protect against replays.
    – user49075
    Feb 17, 2015 at 3:07
  • Can you explain?
    – Krypton
    Feb 17, 2015 at 3:08
  • 1
    Ricky, how would it? (given the attacker does not know M or K?)
    – Chris S
    Feb 17, 2015 at 3:09
  • Just sending N in clear would make the rest of what gets sent completely independent of N.
    – user49075
    Feb 17, 2015 at 3:11
  • 1
    Assume, for the sake of argument, that M is exactly one AES block in length. CBC ciphertexts are malleable, so an attacker can trivially garble the component of the ciphertext containing the nonce. If you don't check that the nonce is one that you have previously sent (and not simply one you haven't seen before), an attacker will be able to replay any message he pleases. You may want to a) use CTR and have an incrementing IV and no nonce, b) use an AEAD mode like GCM with the nonce as the AAD instead of part of the plaintext, or c) just use TLS and avoid reinventing the wheel. Feb 17, 2015 at 3:48

1 Answer 1

1

Nonces do not necessarily have to be secret, their only use is to ensure that a message is unique.

Basically, the fact that a plaintext includes a nonce means that the ciphertext is of no use to an attacker.

An attacker being able to influence the nonce is a different issue and will likely cause some problems in protocols that depend on it.

8
  • what is the issue of attacker being able to influence the nonce?
    – Krypton
    Feb 17, 2015 at 3:15
  • If they can influence the nonce during a handshake to a known nonce from a captured ciphertext then they can replay the ciphertext.
    – Chris S
    Feb 17, 2015 at 3:19
  • I am not doing any handshaking here though.
    – Krypton
    Feb 17, 2015 at 3:23
  • Having the client send a nonce, then the server responding with the encrypted message is really a handshake :) Ensure that the client actually validates the nonce and you'll be golden.
    – Chris S
    Feb 17, 2015 at 3:35
  • I'm having a nonce in this scenario so that the client can validate the response from server.
    – Krypton
    Feb 17, 2015 at 3:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .