Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

On Wed, Dec 4, 2013 at 10:06 PM, Martin Rex <mrex@sap.com> wrote:
<snip>
>
> The fragility of GCM worries me personally much more than the
> attack surface of mac-pad-encrypt, e.g.
>
>   Cycling Attacks on GCM, GHASH and Other Polynomial MACs and Hashes
>   Markku-Juhani O. Saarinen
>   http://eprint.iacr.org/2011/202.pdf
What on earth convinced you this paper presented an interesting
result? Why is this forgery more
interesting than all the other forgeries? If you had bothered to do
more research you would see that in the
GCM standardization process this came up, and was appropriately
responded to with "that doesn't change
the security claim, and isn't interesting at all" (paraphrasing).
Mac-pad-encrypt reveals plaintext data. The above doesn't do anything
because if you pick a key uniformly at
random the probability a forgery succeeds is the probability q(x) has
a root at k, which is bounded by things like
being in a field. (Figure it out as an exercise in elementary algebra)
It doesn't matter what form q(x) has.
If you think the above is more worrying than mac-pad-encrypt, you
shouldn't be commenting on cryptography.
Sincerely,
Watson Ladd
>
>
> -Martin
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin