Skip to main content

Questions tagged [nonce]

a random number that is only used once. It is generated at the beginning of a communication by one communication partner and has to be sent back by the other one in order to prevent replay attacks.

Filter by
Sorted by
Tagged with
91 votes
4 answers
68k views

What is the use of a client nonce?

After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
user2014's user avatar
  • 1,013
64 votes
3 answers
62k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
Stu Pegg's user avatar
  • 743
38 votes
3 answers
19k views

How long should a random nonce be?

NIST provides good guidelines on the length of keys and hashes for various algorithms. But I don't see anything specifically on the length of a random or pseudo-random nonce (number used once). If ...
nealmcb's user avatar
  • 20.8k
35 votes
4 answers
21k views

Why does the SSL/TLS handshake have a client and server random?

In the SSL handshake both the client and server generate their respective random numbers. The client then generates a pre master secret and encrypts it with the server's public key. However, why can't ...
George Robinson's user avatar
34 votes
1 answer
4k views

How does a nonce reset allow for decryption?

I'm sure that by now most InfoSec-lovers have heard about KRACK. If you haven't, check out this great explaination by a fellow StackExchanger. It's a new attack on WPA2 which allows for decryption ...
FMaz's user avatar
  • 472
24 votes
2 answers
8k views

Openid connect nonce replay attack

The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent ...
user3072507's user avatar
19 votes
2 answers
35k views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
meriton's user avatar
  • 1,488
13 votes
2 answers
14k views

when to use nonce?

I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to ...
Loonb's user avatar
  • 293
12 votes
1 answer
5k views

SSL replay attack when client/server random is missing

Hey studying the SSL protocol, I'm wondering how can someone be able to do a replay attack if the server nonce is missing? All the material I find says that nonces prevent it, but theres no examples ...
ddayan's user avatar
  • 223
11 votes
1 answer
4k views

TLS replay attack - requirements of the serverHello nonce

As you all know, the SSL/TLS protocol requires both client and server to exchange (in clear text) a random number or nonce. This is presumably used to prevent replay attacks. It is not clear to me ...
Louis's user avatar
  • 373
10 votes
1 answer
4k views

Is it possible to implement a nonce without storage?

I am looking at implementing an authentication module using OAuth 2.0 Client and I am trying to avoid having any server state. I was going thorough a few other questions when to use nonce? Is it ...
Archimedes Trajano's user avatar
9 votes
2 answers
15k views

What's the point of the nonce in CTR mode?

Does having a nonce in CTR mode actually improve security (vs. just using 1, 2, 3, etc. - basically a constant nonce of 0)? As far as I can tell, the best-case scenario security-wise is that the ...
Neil Fitzgerald's user avatar
9 votes
1 answer
4k views

Is it possible to have stateless server nonces in HTTP Digest

When implementing a HTTP Digest server, there's the issue of nonces. Server nonces (as opposed to client nonces) must be issued by the server may be re-used by clients as long as the server allows ...
mogsie's user avatar
  • 255
9 votes
3 answers
3k views

According to RFC 5246, are nonces in TLS useless (in terms of security) and if yes, why aren't they only random data?

I know the common usage of nonces in security (which is well described in this topic). However, when checking the SSL/TLS protocol, we can notice, according to the RFC, that nonces as ClientHello....
blingbou's user avatar
8 votes
1 answer
3k views

Prevent cross domain form submission with nonce?

I haven't done much in web security before but am now in need to prevent a form from being submitted from anything but my own domain. I know how to lock this down in an .htaccess file but the ...
Brigante's user avatar
  • 203
8 votes
2 answers
4k views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at https://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
Evgeniy Berezovsky's user avatar
8 votes
3 answers
3k views

What is the use of nonces in HTTPS APIs

I have used APIs that require a nonce for every request. If HTTPS requests are not replayable, seen here https://stackoverflow.com/a/2770133/2800469, what is the reason to require nonces for HTTPS ...
ajb32x's user avatar
  • 181
8 votes
3 answers
3k views

How can salted, hashed password storage be combined with a plaintext, nonce and hash based authentication?

My understanding is as follows: To securely store a password (e.g. in a database), you use a hashing algorithm designed for this purpose (designed to be slow, e.g. bcrypt), and you use a unique salt ...
Tim's user avatar
  • 183
8 votes
1 answer
781 views

Encrypting short identifiers?

I am developing a webapp that does not reveal record count, because it hides the primary key. I am looking for a better way to do this. My favorite idea is to encrypt the ID itself with a block ...
700 Software's user avatar
8 votes
1 answer
2k views

Why isn't Amazon using a NONCE for REST Authentication?

When you look at Amazons RESTAuthentication you can see that it doesn't use a nonce: Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature; Signature = Base64( HMAC-SHA1( ...
laktak's user avatar
  • 181
7 votes
3 answers
2k views

chosen plaintext attacks against MD5 and SHA1

According to https://www.rfc-editor.org/rfc/rfc2617#section-4.9, having the server chose a nonce but not having the client chose a nonce opens up Digest Access authentication to chosen plaintext ...
paynes_bay's user avatar
7 votes
2 answers
4k views

How to store nonce and key when working with libsodium secretbox?

Why am I asking? I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming ...
wire417's user avatar
  • 179
6 votes
3 answers
4k views

AES use same Nonce security risk?

If I use AES-GCM and encrypt data with a 128 Bit Key and always use the same Nonce. Is using the same nonce a security risk? Can a hacker guess the Key? Or is the Nonce only to verify that the ...
John Smith's user avatar
6 votes
1 answer
710 views

Adding salt to TOTP

I'm building an high velocity auth system, used both for user to machine and machine to machine authentication and authorization. To prevent a replay attack I'm adding a nonce to each request, but in ...
Mascarpone's user avatar
5 votes
3 answers
3k views

optimal way to salt password?

A good way to salt password? I have read a few answers related to salting password. But I started to get confused. I came across few functions people used to generate salt like: mcrypt_create_iv() ...
Loonb's user avatar
  • 293
5 votes
2 answers
9k views

Preventing resubmission and replay attack using client nonce in REST API

I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. The client side is iOS/Android app. I want to add a layer of safeguard on critical API by ...
mingchuno's user avatar
  • 153
5 votes
2 answers
18k views

nonce in SSL/TLS handshake

In SSL/TLS handshake, a nonce is always sent by the client to server and vice versa. The nonce basically consists of a random number and unix timestamp. Why do we need the unix timestamp? As the ...
asit_dhal's user avatar
  • 169
4 votes
1 answer
2k views

What purpose do nonces serve in the TLS 1.3 handshake?

In general, I understand that nonces are used to prevent replay attacks, but in the case of a TLS 1.3 handshake, the Client/Server Hello message contains their public keys. Considering that keys are ...
tired_owl's user avatar
4 votes
3 answers
5k views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server (...
Anders's user avatar
  • 65.6k
4 votes
2 answers
6k views

how to store and retrieve nonce in practice

As nonce is supposed to be random and used only one time, when receiving a nonce, I need to check it with all past nonce records. That means I need a database to store every nonce I had before. Of ...
Sissi's user avatar
  • 49
4 votes
1 answer
350 views

Is this the correct flow of the KRACK attack?

I am not cryptography expert so please forgive this basic question. I am trying to understand how the flow of the KRACK attack takes place in order to better understand why the encryption protocol ...
ng.newbie's user avatar
  • 275
4 votes
2 answers
625 views

How to properly manage WebAuthn challenges?

I'm in the process of evaluating adding WebAuthn/Passkey support to a website, and I'm not really sure how to properly manage challenge nonces. My understanding is that the main reason for using ...
Dolda2000's user avatar
  • 201
4 votes
2 answers
369 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
Nimyz's user avatar
  • 203
3 votes
1 answer
1k views

Is it ok to append the nonce/iv to the ciphertext when using AES GCM?

I want to use AES GCM to encrypt data at rest. When retrieving the data, I want to make sure that the key is valid and the data has not been tempered with. Can I store the nonce/iv along with the ...
machete's user avatar
  • 247
3 votes
2 answers
4k views

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing the Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however, I read another simple article, that ...
MattyMerrix's user avatar
3 votes
1 answer
3k views

Replay attack example for validating nonce?

I am trying to validate a JWT token received from Windows Azure. I am following the documentation here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-tokens/#validating-...
User52016's user avatar
  • 145
3 votes
1 answer
2k views

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
orlp's user avatar
  • 391
3 votes
0 answers
256 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify App ...
Domi's user avatar
  • 131
2 votes
1 answer
927 views

Why is salt+nonce authentication over insecure channel vulnerable to man-in-the-middle attack?

In a network connection over an insecure channel I do the following: Server sends database salt and a nonce to the client; Client computes and sends hash(hash(pwd + salt) + nonce); Server computes ...
OLEGSHA's user avatar
  • 135
2 votes
1 answer
2k views

How to synchronize a nonce between two participants?

I am currently working with a symmetric algorithm which requires a nonce for encryption, and logically for decryption as well. However, I am a bit confused about how I would go and synchronize the ...
Sossenbinder's user avatar
2 votes
2 answers
5k views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique does ...
az_'s user avatar
  • 165
2 votes
1 answer
787 views

Is it insecure to ask for the current nonce from server?

I'm developing an embedded application that delivers information through HTTP to my web server. These deliveries are secured by a hash H(secret : data : nonce) where the secret is shared between the ...
m__'s user avatar
  • 135
2 votes
1 answer
897 views

If we use only client nonce and not server nonce, which attack vectors become possible?

As we all know, nonce is needed to prevent replay attacks. Everywhere I read about nonce, I see that client always fetches one from the server, and, to improve security even more, it also can add its ...
Dmitry Frank's user avatar
2 votes
1 answer
4k views

WPA/WPA2 Handshake -- A question on the computation of the MIC

During the WPA/WPA2 4-way handshake, the first two steps are as follows. (1) The AP sends an ANonce to the client, (2) The client computes its own Nonce (SNonce), computes the Preshared Transient Key (...
Minaj's user avatar
  • 1,576
2 votes
1 answer
793 views

IKEv2: Why is it important "that each side sign the other side's nonce"

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
sege's user avatar
  • 23
2 votes
1 answer
1k views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
NullHypothesis's user avatar
2 votes
1 answer
543 views

Openid nonce replay attack in auth code flow

Looking at this question Openid connect nonce replay attack and the answer by @benbotto. I understand the replay attack in implicit flow but unable to understand it for auth code flow. Let's say an ...
user267581's user avatar
2 votes
1 answer
327 views

Risk associate with nonce and hash found in url

I have came across a url with nonce and hash in placed which is an account activation link sent via email. The example is as followed: http://example.com/competition/?r=user/activateaccount&...
Traveller's user avatar
  • 103
2 votes
3 answers
2k views

How to create a secure nonce for WSSE

I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important. I found very different implementations: * http://www....
PiTheNumber's user avatar
  • 5,424
2 votes
1 answer
352 views

How were Cryptographic nonces used in the Yahoo! data breach?

How does an attacker use Cryptographic nonces to generate access cookies through a script on a server? As what happened to Yahoo! servers.
Ayush Ambastha's user avatar