Re: [TLS] Encrypt-then-HMAC is the only credible choice. Here's why:

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, Nov 14, 2013 at 10:00 PM, Marsh Ray <[e-mail]> wrote:
>
>
> Our knowledge of generic hashing constructions has evolved:
[...]
> My conclusion is that for any reasonable choice of hash function, the TLS
> PRF is noninvertible. To put this another way, if this feat were
> demonstrated even using the horribly broken MD5 it would be earth-shattering
> in its crypto impact. It is secure forever, unless there are seriously
> fundamental advances in complexity-theoretic cryptanalysis. And if that day
> comes, *it will be your fast ciphers that you’ll worry about*. The TLS PRF
> is by far the slowest, most conservatively designed stream cipher in common
> use.

Hello,
 These are interesting facts and I don't think anyone denied them in
this list. The fact however that EtA is ok, doesn't imply that AtE is
not ok. The only stream cipher in TLS had never issues due to the mode
of encryption (AtE). Why switch it to EtA when we know the issue and
can fix (fix and not hack) the currently used mode?

In any case that is argumentation for the sake of argumentation. Now
we are full of hacks solving the issue and what we need is some action
on this topic.

regards,
Nikos