I want to implement a client that generates random 48-bit values and send them as broadcast messages. We assume also there is a legitimate receiver getting those values (so, there is some sort of pre-authentication that has already happened but it is not of importance here. We can also assume the client/receiver share a common key $K$). Since these are broadcast messages it means also that anyone can intercept those values. I would like those values to have two properties:
- It is difficult for an attacker to guess the next random value in the sequence
- The receiver should be able to verify that these values are indeed coming from the specific client
I was thinking of a simple scheme that does the following:
$t$ = AES-CTR($K$, nonce||counter, random_plaintext)
$r = t ⊕ K$ (keep last 48 bits)
Broadcast $t, r$
I use AES-CTR to generate a temporary random looking string $t$ and then XOR it with the key once again to generate my random value. I then keep the last 48 bits and broadcast both $t$ and $r$. Then the receiver can simply:
- $r' = t ⊕ K$ (keep last 48 bits)
- Verify $r' == r$
If the check succeeds then he authenticates the client because only he knows the same key $K$. Also the value being an output of AES-CTR should be fairly random meaning it is very difficult for someone to guess the next one.
Does this scheme achieve my requirements? Does the truncation of the last 48 bits pose a security risk?