Why does OAuth 1.0a require random nonces and how random should they be?

gaazkam

5/10/23, 11:20 AM

What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put.

The OAuth 1.0a specification states that:

A nonce is a random string, uniquely generated by the client to allow the server to verify that a request has never been made before and helps prevent replay attacks when requests are made over a non-secure channel. The nonce value MUST be unique across all requests with the same timestamp, client credentials, and token combinations.

Why does OAuth 1.0a require randomness?

Also I find it surprising that the spec says 'random' without explicitly requiring cryptographically secure randomness. What could be the benefit of a random, but not cryptographically secure random nonce? I suppose I should understand that the requirement of cryptographically secure randomness is implied here?

0 + 0

signature

nonce

Maarten Bodewes

5/10/23, 4:45 PM

OAuth basically defines a framework on how authentication tokens can be established. It doesn't go deep into security whatsoever. The authentication framework is secure, but only if it gets configured properly. For OAuth 2 there is a separate RFC with security requirements, which is very much needed. Strangely enough, OAuth 1 does specify requirements for the secrets used. Non-secure random RNG's may not be seeded properly (which may not be such a big issue if the RNG is always started with a fresh tim-stamp) and they are fast, but I'd use a large nonce from a well seeded CSPRNG anyway.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why does OAuth 1.0a require random nonces and how random should they be?

TH: เหตุใด OAuth 1.0a จึงต้องการ nonce แบบสุ่ม และควรสุ่มอย่างไร

RO: De ce OAuth 1.0a necesită non-uri aleatorii și cât de aleatorii ar trebui să fie?

RU: Почему OAuth 1.0a требует случайных одноразовых номеров и насколько они должны быть случайными?

VI: Tại sao OAuth 1.0a yêu cầu các nonce ngẫu nhiên và chúng nên ngẫu nhiên như thế nào?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.