Description
Nonces should be used for the present occasion and only once.
Nonces are often bundled with a key in a communication exchange to produce a new session key for each exchange.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: High
Related Weaknesses
CWE-344
Consequences
Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity
Potentially a replay attack, in which an attacker could send the same data twice, could be crafted if nonces are allowed to be reused. This could allow a user to send a message which masquerades as a valid message from a valid user.
Potential Mitigations
Phase: Implementation
Description:
Refuse to reuse nonce values.
Phase: Implementation
Description:
Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.
CVE References
