Secure Programming Cookbook for C and C++

4.9. Using Salts, Nonces, and Initialization Vectors

Problem

You want to use an algorithm that requires a salt, a nonce or an initialization vector (IV). You need to understand the differences among these three things and figure out how to select good specimens of each.

Solution

There’s a lot of terminology confusion, and the following Section 4.9.3 contains our take on it. Basically, salts and IVs should be random, and nonces are usually sequential, potentially with a random salt as a component, if there is room. With sequential nonces, you need to ensure that you never repeat a single {key, nonce} pairing.

To get good random values, use a well-seeded, cryptographically strong pseudo-random number generator (see the appropriate recipes in Chapter 11). Using that, get the necessary number of bits. For salt, 64 bits is sufficient. For an IV, get one of the requisite size.

Discussion

Salts, nonces, and IVs are all one-time values used in cryptography that don’t need to be secret, but still lead to additional security. It is generally assumed that these values are visible to attackers, even if it is sometimes possible to hide them. At the very least, the security of cryptographic algorithms and protocols should not depend on the secrecy of such values.

Tip

We try to be consistent with respect to this terminology in the book. However, in the real world, even among cryptographers there’s a lot of inconsistency. Therefore, be sure to follow the directions in the documentation for whatever primitive ...