Nonce Handling

Hello All,

I am still unclear on how the nonce value is dealt with in <CipherData>. The
schema definition says that the attribute value is supposed to be Base-64
encoded binary value, but there is no mention of the actual value itself. Is
it just an integer length of the nonce? If so, why even bother with encoding

Also, this sentence is confusing (Section 3.2):

"The optional Nonce attribute specifies the presence and length of a nonce
value that is prepended to the CipherValue or data identified by the

This isn't exactly correct - the nonce is prepended to the plain-text, not
the cipher text, correct? (Maybe I am wrong.)

Blake Dournaee
Toolkit Applications Engineer
RSA Security
"The only thing I know is that I know nothing" - Socrates

-----Original Message-----
From: Christian Geuer-Pollmann
Sent: Saturday, November 03, 2001 2:28 AM
To: XML Encryption WG
Cc: Joseph Reagle
Subject: Encrypting IV in ECB

Hi all,

about the use of the IV in block encryption in CBC mode: 
[Menezes/Orschoot/Vanstone] state in Remark 7.16 (integrity if IV in CBC):

  "While the IV in the CBC mode need not be secret, its
   integrity should be protected, since malicious
   modifications thereof allows an adversary to make
   predictable bit changes to the first plaintext
   block recovered."


If we encrypt the IV in Electronic Codebook Mode (ECB), we ensure that 
modifications on the bit layer will break decryption of the complete block.

  "ALGORITHM is used in the Cipher Block Chaining
   (CBC) mode with a ALGO_KEY_BIT_LENGTH bit
   Initialization Vector (IV). <ADD>The IV is
   encrypted in ECB mode.</ADD> The resulting
   cipher text is prefixed by the
   <ADD>encrypted</ADD> IV."

Does this make sense to you?

Best regards,

[Menezes/Orschoot/Vanstone] Handbook of applied cryptography, page 230

Received on Sunday, 4 November 2001 20:09:12 UTC