Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

[[e-mail] (Martin Rex)]

Ralf Skyper Kaiser wrote:
>
> With EtA you need to trust the MAC. With AtE you need to trust the cipher
> _and_ the MAC.

I believe you're confused.

The MAC provides integrity protection, the Encryption provides
confidentiality.  The quality of the MAC has exactly Zero impact
on the confidentiality provided by the Encryption.

For EtA, the characteristics&quality of the Cipher do not affect
(and therefore can not improve) the quality of the MAC scheme
at all.

For AtE, the characteristics&quality of the Cipher additionally
strengthen the quality of the MAC scheme, so weaknesses in the MAC
scheme do not immediately translate into a vulnerability.

Look at AES-GCM (NIST SP800-38D).  They use an efficient keyed has GHASH,
that does not have cryptographic hash properties (2nd paragraph Page 10):

  http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf

  GHASH is a keyed hash function but not, on its own, a cryptographic
  hash function. This Recommendation only approves GHASH for use within
  the context of GCM.

The use of GHASH without cryptographic protection would not be safe.


-Martin