[saag] MAC first then encrypt or encrypt then MAC.

[Phillip Hallam-Baker <[e-mail]>]

OK, so I think I know the answer to this one, but every single time I
submit a spec doing it one way, someone will always tell me that the
other is the way to go. And very rarely will anyone give a reason
other than 'that is how to do it'.

And no, 'just use TLS or DTLS' is not an option in this particular protocol.

I have found http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html
but while the paper is very good and worth reading, it is focused on
public key issues. I am wondering if some of the 'you must sign first'
advice is coming from people translating advice specific to public key
back to symmetric key protocols.


What I am planning to do is:

1) Starting from a master shared secret km produce distinct keys ks,
ke for signing and encryption respectively.

[e.g. ks = MAC ("sign", km), ke = MAC ("encrypt", km)]

2) Construct either

Encrypt-then-sign  Message = Encrypt (Payload, ke) + Authenticate
(Encrypt (Payload, ke), ks)

Sign-the-encrypt  Message = Encrypt (Payload + Authenticate (Payload, ks), ke)

[I am aware that certain communities would advise

  P2 = Encrypt (Payload + Authenticate (Payload, ks), ke)
  Message = Encrypt (P2+ Authenticate (P2, ks), ke)

But I don't have the room for it]


What I am really looking for here is not so much an argument as a
reference I can cite.

Looking at the current JSON signature etc spec it looks to me like
Encrypt-then-sign is expected.


This is to be used in:
http://www.ietf.org/id/draft-hallambaker-omnibroker-00.txt in case you
need context.

-- 
Website: http://hallambaker.com/