A Letter to the Editor

Please find enclosed our manuscript, Bounded Nonces Considered Sufficient, which we submit for consideration in the Journal's autumn number. The paper asks a narrow question — how wide must a single-use token be? — and answers it with a bound, a construction, and a measurement over 1.6 million synthetic responses.

We believe the result will interest your readers for one reason above the others: the folklore it retires is expensive. Implementers pay generation and transport cost for width they never measure, and the paper shows the marginal security of those bits falling off exponentially while their cost stays constant. The enclosed talk version of the argument was delivered at our colloquium this spring without riot or refutation, which we take as encouragement.

Three notes for the record:

• The measurement corpus and the generator are enclosed as artifacts, content-addressed, so any referee may re-derive Table 2 exactly.
• A companion page presents the argument as a talk; the manuscript stands alone without it.
• We have no conflicts to declare, unless a fondness for narrow questions counts.

We suggest, with the usual deference, that the paper be read by someone who has shipped a token generator in anger; the proofs are short but the folklore is stubborn.