On 7/8/19 6:04 PM, Stephen Frost wrote: > * Bruce Momjian (br...@momjian.us) wrote: >> Uh, well, renaming the user was a big problem, but that is the only case >> I can think of. I don't see that as an issue for block or WAL sequence >> numbers. If we want to use a different nonce, we have to find a way to >> store it or look it up efficiently. Considering the nonce size, I don't >> see how that is possible. > > No, this also meant that, as an attacker, I *knew* the salt ahead of > time and therefore could build rainbow tables specifically for that > salt. I could also use those *same* tables for any system where that > user had an account, even if they used different passwords on different > systems... > > I appreciate that *some* of this might not be completely relevant for > the way a nonce is used in cryptography, but I'd be very surprised to > have a cryptographer tell me that a deterministic nonce didn't have > similar issues or didn't reduce the value of the nonce significantly.
I have worked side by side on projects with bona fide cryptographers and I can assure you that they recommended random nonces. Granted, that was in the early 2000s, but I don't think "modern cryptography" has changed that any more than "web scale" has made Postgres irrelevant in the intervening years. Related links: https://defuse.ca/cbcmodeiv.htm https://www.cryptofails.com/post/70059609995/crypto-noobs-1-initialization-vectors Joe -- Crunchy Data - http://crunchydata.com PostgreSQL Support for Secure Enterprises Consulting, Training, & Open Source Development
signature.asc
Description: OpenPGP digital signature
