Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

[Nikos Mavrogiannopoulos <[e-mail]>]

On Fri, 2013-11-29 at 09:26 -0800, Robert Ransom wrote:

> > You have been quite clear about that, and I've got the impression that you
> > are the only but very vocal opponent of encrypt-then-mac on this list.
> 
> Nikos Mavrogiannopoulos has also been opposed to encrypt-then-HMAC.  I
> don't know of any others.

It seems I'll have to repeat that. I don't oppose this draft. I prefer
an alternative [1], which was not mentioned in the IETF88 meeting. So if
the question would be AEAD (i.e, not a fix) or encrypt-then-mac, I'd go
with the latter. If the question is [1] or encrypt-then-mac I'd go with
the former.

> > I'm sure you have good reasons for this opposition, so could you
> please
> > explain them in one or two sentences. This excluding the "encrypting
> the
> > HMAC makes it safer" argument, which might be true but as I
> understand is
> > not well proven.
> "not well proven" is the wrong phrase here.  Marsh Ray solidly
> debunked it.

I don't quite understand that. No-one questioned his observations in any
point at any previous discussion. Please review them to understand where
I stand.

regards,
Nikos

[1].
http://tools.ietf.org/search/draft-mavrogiannopoulos-new-tls-padding-01