Re: [Cfrg] NSA sabotaging crypto standards

Don Johnson, for one. Carl Meyer. (Yes, those guys who invented Lucifer and DES ciphers.)

You keep forgetting (or simply aren't old enough to be aware?) of how things were done back when the "Cryptography: The New Dimension" book was published.

The standard was "MAC, then Encrypt", and it had reasons for doing things in that order. In fact, SNMP was the first IETF protocol (circa 1992-1994) to diverge from that approach, and it took some flak for not doing what was the conventional wisdom of that day.

Since then the priorities and the attacks changed, and now "Encrypt-then-MAC" is the standard.

Watson, I'd like to join other suggesting that you become less combative here. I'm not a "peacenik" myself, but any patience has a limit.

--
Regards,
Uri Blumenthal                            Voice: (781) 981-1638
Cyber Systems and Technology   Fax:   (781) 981-0186
MIT Lincoln Laboratory                Cell:  (339) 223-5363
244 Wood Street                        Email: <uri@ll.mit.edu>
Lexington, MA  02420-9185       

Web:  http://www.ll.mit.edu/CST/

MIT LL Root CA: 

 <https://www.ll.mit.edu/labcertificateauthority.html>

DSN:   478-5980 ask Lincoln ext.1638

----- Original Message -----
From: Watson Ladd [mailto:watsonbladd@gmail.com]
Sent: Friday, February 07, 2014 11:28 AM
To: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Cc: cfrg@irtf.org <cfrg@irtf.org>
Subject: Re: [Cfrg] NSA sabotaging crypto standards

On Fri, Feb 7, 2014 at 8:11 AM, Nikos Mavrogiannopoulos <nmav@gnutls.org> wrote:
> On 02/07/2014 04:59 PM, Watson Ladd wrote:
>
>> But let's go into detail about how well the cryptographers did in TLS.
>> In 1995 Phil Rogaway tells everyone to use encrypt-then-MAC.
>
> I believe you are oversimplifying things. Indeed Rogaway suggested
> encrypt-then-MAC, but other cryptographers were suggesting
> MAC-then-Encrypt (authenticate what is meant not what is sent). There
> was also no attack known for MAC-then-encrypt.

Show me one cryptographer who recommended MAC-then-Encrypt.
Also, absence of known attacks is not the same as absence of attacks.
Encrypt-then-MAC was the conservative choice.

>
> In general it is very easy to see the obvious solution 20 years later,
> but the challenge is to properly decide at the right time.

It was obvious then: encrypt-then-MAC was known secure, while
MAC-then-encrypt was not.
Any excuse vanishes with Bellare-Nampare (2000). Of course, even if we
take the best interpretation, the TLS WG frittered away 9 years after
being informed of an attack.

Sincerely,
Watson Ladd
>
> regards,
> Nikos
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin
_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
http://www.irtf.org/mailman/listinfo/cfrg