4
$\begingroup$

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other.

My plan is to implement a challenge response system to authenticate both ends of the communication. Instead of separately generating a unique value for the challenge, my intention is to use the nonce as the challenge and then encrypt the nonce using ChaCha20 and the pre-shared key for the challenge response.

Is it safe to encrypt the previous nonce? This will not be a random unpredictable value, but it will be unique and it wont be the same nonce that is used to encrypt the current packet. The attacker will know both the plain text and the encrypted form (is they know the protocol), but this only helps for a brute force attack, I believe?

The packets are authenticated with poly1305 using the same key.

|improve this question
$\endgroup$
  • 1
    $\begingroup$ The security concept is getting lost in the packet details. See Challenge-Handshake Authentication Protocol Working cycle. The authenticator is the door opener, the peer is the push button. The secret is pre-shared key. Step 4 is not required in your case. $\endgroup$ – zaph Dec 12 '17 at 12:33
  • $\begingroup$ I guess the crux of my question is, is it cryptographically secure to use the nonce as the challenge, followed by the encrypted nonce as the response. From reading through the above linked article, I would say yes. $\endgroup$ – microwavesafe Dec 12 '17 at 13:20
1
$\begingroup$

In general symmetric ciphers are not vulnerable to attacks with known plaintext. So in general it is perfectly possible to encrypt the previous nonce.

With multiple nodes it would be a good idea to include the identity of the sender / receiver in the challenge or at least in the poly 1305 based authentication. Otherwise an attacker may trick a node into authenticating a different node than intended.

|improve this answer
$\endgroup$
  • $\begingroup$ Thanks for your answer. The poly1305 MAC already includes the sender and receiver by network address, so this should be covered. $\endgroup$ – microwavesafe Oct 25 '18 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.