Re: [TLS] Consensus Call on MTI Algorithms

[Peter Gutmann <[e-mail]>]

Hanno =?UTF-8?B?QsO2Y2s=?= <[e-mail]> writes:

>Other options: AES-CBC with EtM (Peter Gutmann just claimed here he thinks
>its less brittle than GCM) or other block modes (OCB?).

I've always liked OCB, and the removal of encumbrance for TLS implementations
finally makes it available for use there.  GCM is just too brittle, a minor
implementation flaw (as has already occurred in things like tarsnap and JCE)
leads to a complete loss of security, while the same flaw using CBC (and
presumably OCB) leads to mostly theoretical weaknesses.  GCM (or at least its
underlying primitive, CTR) is RC4 all over again, and we're already seeing
some of the same mistakes that killed RC4 use appearing in GCM deployments.

Peter.