Re: [Cfrg] Halon's Razor -> Re: NSA sabotaging crypto standards

[Paul Lambert <[e-mail]>]

Premature click-itis on prior post - sorry, please ignore …….

Changing the subject line since we are moving beyond the NSA conspiracy
theories.  The increased interest in security is a great benefit  but
much of our problems I fear are of our own creation:

    "Never attribute to malice that which is adequately explained by
Stupidity”    :-(

Improvements come not from accusations of past work, but a work plan to
look at new activities and better criteria.

Concrete suggestions:
 - identification and documentation of vulnerabilities and possible
“mistakes" 
 - identification and documentation of selection criteria
    - very interesting for ECC
      e.g. Benefits or issues of a = -3, p = pseudo mersenne,
      impact of zero value points and DPA
 - protocol review and refresh of guidelines and/or protocols
   - e.g. IPsec has a guideline I know needs changing …
 - re-examination of privacy in protocol designs
   - addresses, names and long term identifiers are the norm
     now … changes are possible


>>
>>I believe you are oversimplifying things. Indeed Rogaway suggested
>>encrypt-then-MAC, but other cryptographers were suggesting
>>MAC-then-Encrypt (authenticate what is meant not what is sent). There
>>was also no attack known for MAC-then-encrypt.
>
>Show me one cryptographer who recommended MAC-then-Encrypt.
>Also, absence of known attacks is not the same as absence of attacks.
>Encrypt-then-MAC was the conservative choice.

SIV is MAC then encrypt in it¹s own unusual manner.  Conservative from the
view of simplicity of proof does not invalidate other criteria. For
example, Rivest¹s Tweakable Cipher¹s offers potential for breaking away
from conservative conventional block cipher wisdom. There are pseudo
homomorphic applications where it’s more appropriate to MAC-then-encrypt.
There continues to be a gulf between ‘applied crypto’ and 'academic
crypto’.  Adamant mandates of abstract guidelines will not build consensus
or good products.  Progress can be made by more rapid academic analysis of
‘real protocols’, and more rapid translation of academic work into useable
designs.



Paul