Chapter 2 — Cryptography and trust services: research frontier
Lesson map
Lesson 02 published. Map, example, EX008.
flowchart TD
N0["Learning outcomes"]
N1["2.1 What is settled"]
N2["Lab — Random-nonce collision risk"]
N3["2.3 Reading the curve"]
N4["2.4 Misuse-resistance and usability work"]
N5["2.5 Positioning the contribution"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX008"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 What is settled"]
N2["Lab — Random-nonce collision risk"]
N3["2.3 Reading the curve"]
N4["2.4 Misuse-resistance and usability work"]
N5["2.5 Positioning the contribution"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]
[Learning outcomes]
|
v
[2.1 What is settled]
|
v
[Lab — Random-nonce collision risk]
|
v
[2.3 Reading the curve]
|
v
[2.4 Misuse-resistance and usability work]
|
v
[2.5 Positioning the contribution]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX008]
Learning outcomes
You will (1) map the research frontier on usable and misuse-resistant cryptography; (2) quantify a misuse risk from a standard's stated limit; (3) position an original question against what standards already settle.
2.1 What is settled
Primitive security is largely not Nadia's question. AES is specified in FIPS 197, SHA-2 in FIPS 180-4, HMAC in FIPS 198-1, and signatures in FIPS 186-5 and RFC 8032. Boneh and Shoup present the reduction-based proofs that make these choices defensible, and Katz and Lindell show how authenticated encryption composes confidentiality and integrity. A thesis that re-litigates those results would add little. What remains open is the gap between a proven primitive and the code that calls it: parameters, nonces, key storage and protocol glue. That gap is where Meridian's audits keep finding trouble, and where Nadia places her contribution.
2.2 Nonce limits as a measurable risk
Standards often express misuse risk as a usage limit. SP 800-38D requires that, when 96-bit GCM nonces are generated randomly, a single key encrypt no more than 2^32 messages, because random nonces eventually collide and a collision exposes the XOR of two plaintexts and allows authentication-tag forgery. The birthday approximation gives the chance of at least one repeat among q random draws from 2^96 values as roughly q²/2^97. The lab computes that probability for three synthetic volumes to show why rotation policy, not the cipher, is the controllable variable.
Lab — Random-nonce collision risk
"""Birthday-bound estimate for random 96-bit AES-GCM nonces under one key (synthetic volumes)."""
import math
def p_collision(q, bits=96):
# P(at least one repeat among q uniform draws from 2**bits values) ~ 1 - exp(-q(q-1)/2^(bits+1))
return -math.expm1(-q * (q - 1) / 2 ** (bits + 1))
def main():
for label, q in [("pilot service, 1e6 msgs", 10**6), ("busy queue, 2^32 msgs", 2**32),
("unrotated key, 2^40 msgs", 2**40)]:
print(f"{label:<26} P(repeat) = {p_collision(q):.3e}")
q = 2**32
print(f"2^32 limit -> about 1 in {1 / p_collision(q):,.0f}")
if __name__ == "__main__":
main()
Run with python3 lab_nonce.py. Verified output:
pilot service, 1e6 msgs P(repeat) = 6.311e-18
busy queue, 2^32 msgs P(repeat) = 1.164e-10
unrotated key, 2^40 msgs P(repeat) = 7.629e-06
2^32 limit -> about 1 in 8,589,934,594
2.3 Reading the curve
At a million messages the repeat probability is about 6 × 10^-18, negligible. At the 2^32 limit it is about 1.2 × 10^-10, roughly one chance in 8.6 billion, which the standard treats as the acceptable ceiling. A synthetic queue that never rotates its key and reaches 2^40 messages climbs to about 7.6 × 10^-6, a risk no payments regulator would accept for a single key. Nadia draws the research lesson: the cipher was the same in all three rows. The difference came from operational discipline, namely counting invocations and rotating keys, which is exactly the behaviour a checklist and lint step could plausibly change.
2.4 Misuse-resistance and usability work
The frontier includes two responses to misuse. One designs primitives that fail more gracefully, such as nonce-misuse-resistant modes, so that a repeated nonce leaks equality of messages instead of breaking authenticity. The other studies developers and tooling, asking whether library interfaces, documentation or review aids change behaviour. Nadia's study belongs to the second line. She is careful in her literature review to cite only work she has read and verified, and to record for each paper its population, its measure of misuse and whether it measured shipped code or laboratory tasks, because those choices limit comparison.
2.5 Positioning the contribution
From the frontier review Nadia writes a positioning paragraph. Laboratory studies show that developers misuse libraries under time pressure, but few measure confirmed misuse in shipped production changes with randomised assignment. Her contribution is a randomised field study inside one organisation, measured by an audited count per ten merged changes, with a public codebook and analysis archive. She also states what she will not claim: she will not claim the checklist prevents all misuse, nor that results transfer to firms without vetted libraries. Saying what is out of scope keeps the examiners focused on the evidence she can produce.
Worked example
Nadia tabulates the three nonce-volume rows, links the 2^32 limit to SP 800-38D, and argues that rotation discipline is the behaviour her intervention targets.
Synthetic note. The message volumes belong to an invented queue; the 2^32 limit is the real SP 800-38D rule.
Errors and limits
The birthday formula is an approximation for random nonces only; counter-based nonces have different failure modes, mainly state loss after restarts. Never treat a tiny probability as permission to skip rotation.
Exercises
- EX008 — Settled ground. Which questions does Nadia treat as settled, and which open gap does she study? Rubric: 3 = primitive security (FIPS 197, 180-4, 186-5) settled; gap between primitive and calling code open;; 2 = gap only;; 1 = "new cipher";; 0 = none.
- EX009 — GCM usage cap. What usage limit does SP 800-38D set for random 96-bit nonces, and why? Rubric: 3 = at most 2^32 messages per key because collisions leak plaintext XOR and enable forgery;; 2 = limit only;; 1 = "rotate often";; 0 = none.
- EX010 — Probability at the cap. What repeat probability did the lab report at 2^32 messages? Rubric: 3 = about 1.164e-10, about 1 in 8.6 billion;; 2 = order of magnitude;; 1 = other row;; 0 = none.
- EX011 — Unrotated queue. What did the 2^40 row show and what lesson follows? Rubric: 3 = about 7.6e-6; operational rotation, not the cipher, drives risk;; 2 = number only;; 1 = lesson only;; 0 = none.
- EX012 — Two frontier responses. Name the two research responses to misuse and say which Nadia joins. Rubric: 3 = misuse-resistant primitives vs developer/tooling studies; she joins tooling;; 2 = both named;; 1 = one;; 0 = none.
- EX013 — Literature record. What three facts does Nadia record for each paper she reviews? Rubric: 3 = population, misuse measure, shipped code vs lab task;; 2 = two;; 1 = one;; 0 = none.
- EX014 — Scope claim. Give one claim Nadia explicitly declines to make. Rubric: 3 = checklist prevents all misuse, or results transfer to firms without vetted libraries;; 2 = vague limit;; 1 = unrelated;; 0 = none.
Synthesis
The frontier is not in new primitives but in measured behaviour around them; standards' usage limits turn that behaviour into numbers a field study can test.
Continue studying — chapter 02 of 08
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →