Counters and nonces on ECC bits blunt ciphertext side channels in deterministic memory encryption, with low overhead and some integrity h...
4 comments
> Collisions occur after2n writes instead of
> √
> 2n for an n-bit counter.
I think
> Collisions occur after 2n writes instead of
> √
> 2n for an n-bit counter.
If the counter is really just a per-line tweak, then what exact collision model is this counting, birthday-style across independent encryptions, or wraparound on the counter space? Those are very different, and the latter is the one that matters for a deterministic memory scheme. Also, what happens under replay or VM snapshot restore, where the same nonce/counter pair can come back after a crash, does the integrity story still hold or do you need monotonic state somewhere else?
> birthday-style across independent encryptions
No, wraparound and rollback are the real failures here, birthday math is a sideshow.
And the annoying bit is making that monotonic state crash-safe, otherwise the nonce fix just moves the bug.