[hcs-d] Fwd: New Harvard ID Card Announcement

Grant Dasher gdasher at fas.harvard.edu
Thu Jul 10 10:46:29 EDT 2008


2008/7/10 Joshua Kroll <jkroll at fas.harvard.edu>:
> On Thu, Jul 10, 2008 at 2:21 AM, Ivan Krstić
> <krstic at solarsail.hcs.harvard.edu> wrote:
>> On Jul 9, 2008, at 11:45 PM, Joshua Kroll wrote:
>>>
>>> An obvious choice beyond name and HUID for info on the second strip is
>>> a secret unique ID - a nonce unique to the card which would prevent
>>> existential forgery of the type we saw in the old cards.
>>
>> The word 'nonce' does not mean what you appear to think it means.
>
> A nonce is a number used only once. And that's what we'd expect on the
> card. Alternatively, you could build it out of some sort of MAC. I'm
> not sure what you think you're getting at here.
>

I think Ivan means that a "nonce" is usually not something saved
permanently on a card but rather something which is generated on the
fly and used in one particular invocation of an authentication scheme.
 I think you want a different word.

--Grant


More information about the hcs-discuss mailing list