The Policy



Wherever the protocol allows arbitrary data to be used, use data that an attacker cannot guess, even if no current attack is known.


Good targets to search for in standards include the following:
counters
time stamps
packet, session, or host identifiers