Re: [TLS] Comments on

[Watson Ladd <[e-mail]>]

On Mon, Feb 17, 2014 at 6:05 PM, Adam Langley <[e-mail]> wrote:
> On Mon, Feb 17, 2014 at 10:45 AM, Watson Ladd <[e-mail]> wrote:
>> Alternatively, we can
>> encrypt the entire file as one big chunk and decrypt on receipt.  I've
>> still not found a case where one of these doesn't work.
>
> I don't believe that there's any disagreement about the fact that
> operating on the file as one, large chunk works, technically.
>
> The problem is that I believe that it results in dangerous APIs. For
> example, OpenPGP does this and I was very unhappy about it when
> writing this[1] implementation which returns unverified plaintext. I
> called the Reader "UnverifiedBody" and put a big comment in there but
> I think we should be able to do better. The point of AEADs was to
> provide a safer abstraction in the first place, no?
>
> (Niels suggested buffering everything before returning anything and
> that's certainly safe. But I feel that it's somewhat anti-social for a
> library to do so.)

I don't think there is any way around that. If I want to ensure all
read data has property P, and P depends on every byte of input, I need
to look at all the input bytes before revealing any data.

Sincerely,
Watson Ladd

>
> [1] https://code.google.com/p/go/source/browse/openpgp/read.go?repo=crypto#38
>
>
> Cheers
>
> AGL
>
> --
> Adam Langley [e-mail] http://www.imperialviolet.org



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin