Definition

chaffing and winnowing

Chaffing and winnowing are dual components of a privacy-enhancement scheme that does not require encryption. The technique consists of adding false packets to a message at the source (sender end of the circuit), and then removing the false packets at the destination (receiver end). The false packets obscure the intended message and render the transmission unintelligible to anyone except authorized recipients.

At the source, each legitimate message packet is assigned a unique serial number and a message authentication code (MAC). Every serial number and MAC is known to the receiver in advance. Then the bogus packets are added at the source; this is the chaffing process (chaff is the undesirable part of a plant such as wheat that is separated during milling). The chaff packets have the same format as the legitimate ones, and they also have reasonable serial numbers, but they have invalid MACs. It is impossible to tell the difference between the legitimate packets and the chaff except by comparing MACs at the destination.

At the destination, the chaff packets are removed by comparing MACs. This is called winnowing. If an incoming packet has a bogus MAC, it is discarded; if it has a legitimate MAC, it is accepted. Thus, the original message is recovered.

Contributor(s): Steven Elling
This was last updated in September 2005
Posted by: Margaret Rouse

Email Alerts

Register now to receive SearchSecurity.com-related news, tips and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

More News and Tutorials

Do you have something to add to this definition? Let us know.

Send your comments to techterms@whatis.com

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: