Nonce should not be a UUID

[Objective-Cloud]

In AmazonAuthUtils.m there is a method called +nonce which is used to create nonce words. The method is implemented like this:

+(NSString *)nonce
{
    CFUUIDRef uuid   = CFUUIDCreate(kCFAllocatorDefault);
    NSString  *nonce = [(NSString *)CFUUIDCreateString(kCFAllocatorDefault, uuid) autorelease];

    CFRelease(uuid);

    return nonce;
}

I may be wrong here but usually nonce values should be randomly generated. A UUID might not be made out of random bits - depending on the type of the UUID. In fact it is nowhere documented what kind of UUID CFUUIDCreate is creating. If you look in the source code of CF then you will see a lot of #ifdefs that make also use of time instead of random bits.

Even if CFUUIDCreate is creating truly random UUIDs now it is not clear that this won't change. In addition using a UUID here is also semantically incorrect because a nonce is usually just a random arrangement of bytes. As already mentioned UUIDs are not inherently random.

As I already mentioned: I could be totally wrong here but I would use arc4random_uniform(...) to create random and uniformly distributed 32 bit values and then chain them together but I am sure that there is a convenience function somewhere in CommonCrypto.

[turacma]

Thanks for the report. We're currently evaluating how best to update or remove this code in future updates of the SDK. If you have specific suggestions, please submit a pull request.

[turacma]

We released an update to the SDK that includes support for Signature Version 4 for SES. As this was the only service using the nonce code, we've gone ahead and removed it. Thanks again for the report.