Messages, Basic, Standard - How random does a nonce have to be?

[Michael Jones]

Don’t we need to define just how random and unique is acceptable for a nonce value? Something like “Must be a 128 bit cryptographically secure randomly generated value or equivalent”? Where we can refer to some appropriate IETF RFC on what ‘cryptographically secure’ means?

[Nat Sakimura]

Here is a copy of definition of Artifact (which is a nonce) from an our predecessor, Artifact Binding draft.

 The Artifact value must 
 include the string constructed from a cryptographically strong 
 random or pseudorandom number sequence [RFC1750] generated by the OP. 

I think it was taken from SAML Artifact Binding.

Having said that, I wonder if our security model depends on the un-predictability of the nonce. Unpredictability requirement comes in only when the attack gains with prediction. If it is a strict onetime nonce, a simple sequence number is strong enough, and that is probably stronger than time limited cryptographic nonce.

Need to double check if we need unpredictability here.

[Nat Sakimura]

check other occurrence of random as well.

[John Bradley]

re #302 change nonce definition Sec 2.3.1.

→ 04d2484eb44f

[John Bradley]

re #302 change nonce definition

→ 05e718cadf19

[John Bradley]

Messages was OK. Changed Basic and standard.